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Part  1.  Introduction  and  Overview. 


When  organizations  operate  technologies  that  are 
beneficial,  costly  and  hazardous,  they  are  pressed  to  take 
on  goals  of  failure  free  operations.  There  is  a  class  of 
organizations  that  have  accepted  such  goals  and  nearly 
always  achieve  them.  This  is  an  extraordinary  situation, 
deemed  impossible  in  contemporary  organization  theoretic 
terms.  The  research  summarized  here  is  part  of  a  project 
studying  the  organizational  patterns  associated  with  very 
high  levels  of  operational  reliability  in  three  such 
organizations.  One  of  them  is  aircraft  carrier  operations 
at  sea. 

Our  work  with  the  Navy  began  informally  summer  of  1984 
with  a  meeting  of  representatives  of  Air  Traffic  Control, 
Federal  Aviation  Administration;  Electric  Operations, 

Pacific  Gas  and  Electric  Company.  We  met  on-board  USS  Carl 
Vinson,  hosted  by  her  Commanding  Officer,  Captain  Tom 
Mercer,  to  explore  some  of  the  means  and  problems  associated 
with  attempting  to  achieve  very  high  levels  of  reliability 
in  complicated  technological  operations.  It  was  an 
extraordinary  meeting.  Organizational  representatives 
discussed  something  of  the  changes  and  problems  they 
encountered  in  seeking  “failure  free  performance."  They 
conveyed  to  each  other  and  the  academics  there  something  of 
the  complexity  of  the  systems  they  led  and  the  processes 
they  felt  accounted,  in  part,  for  the  very  high  levels  of 
operational  performance  they  effect.  To  our  surprise  the 
hint  of  common  patterns  emerged.  Excitement  rose  and  plans 
for  further  exchanges  were  made. 

Later,  after  a  third  meeting.  Captain  Mercer  noted 
that,  "It's  not  enough  to  just  talk  about  this.  You 
(academics)  have  to  come  see  for  yourselves."  This  began  a 
series  of  informally  arranged  visits  to  USS  Carl  Vinson  and 
then  to  three  weeks  on  board  in  far  east.  The  University  of 
California,  Berkeley,  High  Reliability  Organization  Project 
was  off  the  ground.  Subsequent  work  has  been  carried  on  in 
the  other  organizations  as  well.  [See  a  brief  Project 
summary  in  the  Appendix.] 

After  protracted  discussion,  ONR  support  was  begun, 
March,  1986.  The  major  portion  of  resources  were  spent 
through  Dec.  1986.  Very  modest  suras  of  ONR  funds  remained. 
Contract  extensions,  at  no  cost  to  the  government,  were 
approved  through  March,  1988.  "’his  was  to  assist  in 
completing  the  Navy  portion  outlined  in  the  original 
proposal  (including  work  with  USS  Enterprise)  which  was 
intended  to  cover  18  months  of  work.  The  necessary 
additional  funds  were  provided  by  the  NSF  and  the  University 
of  California,  Berkeley.  This  report  covers  that  portion  of 
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research  and  writing  carried  on  In  supported  by  the  office 
of  Naval  Research.  Additional  work,  especially  that  based 
on  field  work  aboard  USS  Enterprise  is  reported  elsewhere. 
(See  annotated  project  papers  In  appendix.) 

The  rest  of  the  report  Is  organized  as  follows:  Part  2 
is  drawn  from  a  conceptual  paper  defining  and  delimiting  the 
research  problem.  Part  3  summarizes  the  project's  several 
methodological  processes,  and  Part  4  re-prints  an  article 
discussing  the  ONR  stage  findings  that  appeared  In  the  Naval 
War  College  Review,  Autumn,  1987.  An  appendix  includes  a 
stunmary  of  the  overall  three  organization  study  and  an 
annotated  bibliography  of  project  papers. 
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Part  2.  Dimensions  of  the  Research  Problem. 


This  section  outlines  the  character  of  the  research 
problem,  identifies  the  underlying  theories  that  inform  it, 
and  discusses  several  major  aspects  that  have  guided  our 
field  work.  The  section  is  an  abridgement  of  High 
Reliability  Organizations:  The  Research  Challenge  (T.R.  La 
Porte,  K.  Roberts,  and  G.  I.  Rochlin,  1987.)  It  is  limited 
to  the  Navy  portion  of  the  study;  comparative  aspects  have 
been  deleted.  * 

Introduction: 

Many  advanced  technologies  greatly  increase  the 
prospects  for  material  and  social  benefit.  They  also  carry 
the  potential  for  great  biological,  environmental,  human, 
and  social  damage.  Failures  can  be  costly  and  hazardous. 
Both  the  prospects  and  the  potential  hazards  increase  as 
technologies  of  great  power  are  deployed,  increasing  their 
capacity,  organizational  scale,  and  social  complexity.  To 
secure  those  benefits  while  controlling  potential  harm, 
industrial  firms  and  governments  —  as  operators,  promoters, 
and  regulators  —  Impose  conditions  intended  to  make  such 
failures  rare.  Nevertheless,  for  a  number  of  such  systems, 
the  potential  costs  of  operating  failures  rival  the  benefits 
they  provide. 

When  technologies  are  rich  enough  in  benefits  to 
warrant  development,  yet  must  be  operated  reliably  to  avoid 
imposing  unacceptable  costs,  the  process  is  colored  by 
efforts  to  proceed  by  trials  without  error,  even  at  early 
stages  of  development,  lest  the  next  error  be  the  last 
trial.  If  this  is  successful,  and  the  technology  becomes 
widespread,  operating  organizations  are  expected  to  continue 
nearly  failure-free  organizational  performance  —  the 
avoidance  altogether  of  certain  classes  of  incidents  or 
accidents  judged  by  overseers  to  result  in  absolutely 
unacceptable  consequences.*  In  effect,  such  organizations 
attempt  to  operate  so  reliably  that  the  risks  of  the  hazard 
are  radically  reduced.  Benefits,  in  effect,  are  conditioned 


*Examples  abound:  the  extraordinary  problems  of 
operating  nuclear  power  plants;  public  wariness  of  the 
industrialization  of  genetic  engineering;  demands  that  air 
traffic  control  be  failure-  free;  insistence  on  accuracy  in 
identifying  dangerous  drugs;  alarm  regarding  the  safety  of 
bridges  and  dams  and  the  use  of  pesticides  in  agriculture; 
and,  less  dramatically,  concerns  that  the  distribution  of 
electricity,  on  one  hand,  and  computer  based  financial  and 
administrative  data,  on  the  other,  be  quickly  and  very 
accurately  effected  over  very  large  geographical  regions. 


aeuimimmmimmmmmmmummiiiiiiimmimiiim 


5 


! 

1 


on  noarly  failure- free  operations.  And  demonstrating  that 
high  hazard,  low  risk  operations  can  be  realized  over  long 
periods  of  time  is  often  a  requirement  for  public  support, 
government  funding  and  regulatory  approval.** 

Such  a  requirement  is  extraordinary.  Achieving  very 
high  levels  of  reliable  individual  or  group  performance  even 
for  short  periods  is  difficult  at  best.  Attempting  to 
sustain  such  operations  in  large  scale  organizations  facing 
the  contemporary  pressures  of  increasing  performance 
demands,  and  technological  complexity,  poses  very 
substantial  managerial  and  intellectual  challenges. 

Systematic  understanding  of  the  dynamics  and  structure 
of  "high  reliability”  organizations  that  successfully  match 
performance  with  demand  is  quite  limited.  Repairing  this 
situation  calls  for  improved  understanding  of  the  conditions 
and  costs  associated  with  very  high  operational  reliability 
in  organizations  that,  in  pursuing  their  primary  missions, 
have  also  accepted  the  goal  of  always  avoiding  certain 
classes  of  failures  -  and  have  almost  always  succeeded.*** 


**  A  note  on  terms:  Hazard  refers  to  the  characteristic 
of  a  production  technology  such  that  if  it  fails 
significantly,  the  damage  to  life  and  property  can  be  very 
considerable.  Risk  is  taken  in  the  engineering  sense,  i.e., 
the  magnitude  of  harmful  consequences  multiplied  by  the 
probability  of  an  event  causing  them.  Error  refers  to 
mistakes  or  omission  in  procedure  or  operational  decision 
that  result  in  occurrences  judged  as  undesirable  and 
sometimes  costly  to  remedy.  Organizations  continually 
experience  errors,  those  that  result  in  consequences  that 
threaten  their  viability  in  part  or  whole,  result  in  a 
"system  failure".  A  high  hazard/low  risk  system  would  be 
one  in  which  a  dangerous  technology  is  operated  in  such  a 
way  as  almost  never  to  experience  an  operating  failure  of 
grievous  consequence,  i.e.,  to  be  nearly  failure-free.  (See 
W.  w.  Lowrance,  Of  Acceptable  Risk:  Science  and  the 
Determination  of  Safety  (Los  Altos,  CA. :  Wm.  Kaufmann,  Inc. , 
1976),  ch.  2,  and  C.  Hohenemser,  R.  W.  Kates  and  P.  Slovic, 
"The  Nature  of  Technological  Risk,"  Science,  220  (22  April, 
1983),  378-384. 

***  Organizational  reli^U^llity  is  a  condition  in  which 
the  organization  demonstrates  continuously  the  capacity  to 
provide  expected  levels  and  quantity  of  services,  without 
off-setting  failures  of  critical  processes.  In 
organizations  that  accept  this  challenge,  four  types  of 
reli2d>ility  are  involved.  Each  has  distinctive  operating, 
training  and  managerial  implications. 
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six  central  questions  are  prompted  by  these  phenomena 
and  lay  out  their  broader  dimensions: 


^ •  US  a*  1'j  f  H* j  ^ 


1 1  Mi  MW  it-j# 


Organizations  that  exemplify  successful  highly  reliable 
performance  do  not  emerge  full  blown  into  this  state. 
What  were  the  processes  and  circumstances  that  resulted 
in  public  and  organizational  consensus  about  failure 
avoidance?  What  was  the  pattern  of  external  pressures 
to  attempt  failure-free  performance?  Are  there 
distinctive  patterns  and/or  political  conditions  which 
facilitate  this  consensus  and  prompt  the  allocation  of 
the  necessary  resources  to  attempt  the  reduction  of 
operational  failures  altogether? 


Interdependence ♦  These  organizations'  central 
day-to-day  challenge  is  continuously  to  operate 
complex,  demanding  technologies  without  major  failures 
while  maintaining  the  capacity  for  meeting  intermittent 
periods  of  very  high,  peak  production,  e.g.,  peak 
traff ic/power  demand  loads,  or  maximum  air  operations. 
What  patterns  of  formal  organization  structure  and 
rules  have  developed  in  response  to  these  requirements 
under  conditions  of  constrained  resources?  complex 
technologies  tend  to  increase  the  interdependencies 
within  and  among  operating  organizations.  What  are  the 
patterns  of  interdependencies  associated  with  units 
recjuiring  reliability?  What  processes  have  emerged  to 
coordinate  and  manage  them  in  meeting  the  demands  of 
reliability  and  potential  peak  pressures? 


produce 


materials) ;  Assure  continuous,  unbroken  flow  of 
production  input. 


ii)  Reliability  of  f Physical)  Infrastructure:  Seek 
perfection  in  operation/physical  integrity  of  parts, 
pieces  and  networks. 


iii)  Reliability  of  Signals;  Seek  to  perfect  accuracy 
and  timeliness  of  communication  signals. 


operators . 


Seek  to  perfect  performance  of  human 


All  high  reliable  systems  exhibit  reliabilities  ii  - 
iy.  Some  also  satisfy  supply  reliability  themselves; 
most  depend  on  other  organizations  for  the  products 
used  in  operations. 


3. 


Decision  Dynamics  in  High  Demand/Hiah  Reliability 
Conditions .  Top  management  seeks  to  commit  the 
organization  to  high  levels  of  performance,  while 
senior  operating  officials  are  committed  to  assuring 
superior  reliability  (and  safety)  in  the  face  of  often 
unexpected  operating  conditions.  What  decision  making 
and  communication  dynamics  evolve  in  the  processes  of 
day-to-day  planning  and  operation  when  contingencies 
are  expected  but  their  specifics  are  unpredictable? 

How  are  the  operational  constraints  inevitably  imposed 
by  formal  structure  dealt  with,  especially  in 
confronting  those  activities  from  which  unacceptable 
failures  may  arise? 

4.  The  "Organizational  Culture"  of  High  Reliability. 

Formal  structure  and  rules  (SOP's) ,  or  informal 
operating  rules,  rarely  provide  guides  for  behavior 
sufficient  to  account  for  the  technical  and 
cooperative  skills  or  motivations  necessary  for 
effective  organizational  performance.  These  "gaps" 
are  filled  variously  in  the  development  of  an 
organization's  culture.  In  "high  reliabilitv” 
organizations,  the  substance  of  this  culture  is  likely 
to  be  crucial  for  effective  operations.  What  group 
norms  are  evident  within  and  between  units  requiring 
reliability  concerning  relations  with  and  obligations 
to  group  members  and  to  the  organization  as  a  whole? 

How  are  they  created  and  maintained? 

5.  New  Technologies'  Promise;  More  or  Less  Than  Expected. 
New,  often  computer-based,  technologies  are  promoted  in 
high  reliability  organizations  as  a  solution  to  the 
problems  of  expected  demand  and  scarce  resources. 

Where  are  such  technologies  now  being  considered,  and 
for  what  purposes?  What  experiences  have  organizations 
had  to  date  in  incorporating  technologies  possessing 
different  operating  properties  into  working  groups? 

How  have  new  technologies  mixed  with  traditional, 
reliability  trusted  ones  in  day-to-day  activities? 

How  are  organizational  structure,  culture  and 
functions  effected? 

6.  The  Design  of  Consequential  Organizational  Systems. 
Improved  answers  to  these  questions  are  likely  to  shed 
considerable  light  on  the  conditions  and  costs 
associated  with  a  social  dependence  on  hazardous, 
consequential  systems.  What  are  the  implications  of 
these  answers  for  the  design  and  management  of 
technical  systems  and  organizational  processes  in  the 
interests  of  moderating  the  costs  and  stress  of  "high 
reliability"  operations?  Is  it  possible  to  alter 
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technical  design  so  that  the  social  requirements  of 
attaining  high  reliability  will  be  less  surprising  or 
difficult  to  attain?  Can  technical  systems  be  designed 
in  such  a  way  that  regulatory  agencies  faced  with  the 
requirement  to  oversee  "high  reliability"  activities 
may  do  so  without  encountering  tasks  of  such  difficulty 
that  the  regulation  process  itself  is  not  called  into 
question  due  to  the  inability  (perhaps  impossibility) 
of  reasonable  overseeing  efforts? 

Addressing  these  questions  requires:  a  conceptual  basis 
for  defining  the  problem,  including  the  theoretical 
requisites  for  high  reliability  operations;  identifying  the 
limitations  of  current  literature  in  addressing  them;  and  an 
explication  of  the  central  questions  that  should  serve  as  a 
basis  for  intensive  field  observation,  interviews  and  data 
collection  in  units  requiring  high  reliability. . . . 

[The  larger  project  includes  three  organizations:  the 
Air  Traffic  Control  System,  Federal  Aviation  Administration; 
the  Electric  Operations  and  Power  Generation  Departments, 
Pacific  Gas  and  Electric  Company  (managers  of  northern 
Californians  electric  power  distribution  grid;)  and  -  the 
organization  of  interest  here  -  the  U.S.  Navy's  Carrier 
Group  3,  and  U.S.S.  Enterprise  (CVN  65)  and  U.S.S.  Carl 
Vinson  (CVN  70,)  its  two  nuclear  aircraft  carriers  and  their 
respective  air  wings,  CVW-15  and  11.  Each  organization  has 
a  particularly  rigorous  organizational  setting  that  should 
be  taken  into  account  in  considering  these  questions.] 

What  the  types  of  challenges  do  "high  reliability" 
organizations  confront?  ....  Each  of  these  organizations  is 
large,  and  routinely  engaged  in  managing  often  very  intense 
activities,  in  which  time  sensitive  decisions  and  decisive 
actions  are  often  crucial.... 

The  Carrier  Group  involves  up  to  ten  ships,  centered  on 
an  aircraft  carrier  manned  by  a  crew  of  up  to  3000, 
supporting  an  Air  Wing  of  some  90  aircraft  and  another  2800 
men.  During  phases  of  high  readiness  (daily  operations  from 
mid-morning  to  mid-might) ,  the  Air  Department  may  handle  up 
to  some  200  sorties  per  day/night,  involving  some  300  cycles 
of  aircraft  preparation,  positioning,  launch,  and  arrested 
landings  (often  at  about  55  sec.  intervals) .  Over  600 
aircraft  movements  across  portions  of  the  deck  are  likely 
with  a  "crunch  rate,"  i.e.,  the  number  of  times  two  aircraft 
"nick"  each  other,"  of  about  l:7000  moves.  At  the  sa’^e 
time,  aircraft  are  re-  fueled,  serviced  and  ordinance  loaded 
sometimes  with  engines  still  running.  These  periods  of  high 
performance  run  continuously  for  up  four  weeks  time  with 
short  break  for  the  duration  of  a  6-8  month  deployment. 
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Another  property  of  these  organizations  increases  both 
the  difficulty  of  studying  them  and  the  theoretical  value  of 
doing  so:  each  is  embedded  in  a  widely  dispersed  network 
linking  operating  and  coordinating  units  in  a  set  of 
tightly-coupled,  overlapping  interdependent  webs  of 
direction,  action  and  feedback.  (The  effects  of  failures 
propagate  quickly  and  often  widely.)  These  organizations  do 
not  experience  errors  uniformly,  nor  are  they  everywhere 
equally  tightly  coupled.  Rather  they  vary  in  ways  that 
allow  theoretically  interesting  questions  to  be  addressed: 
in  the  expected  magnitude  of  failures'  consequences,  the 
degree  the  functional  interdependence  among  units  requiring 
reliability,  and  the  "tightness"  of  their  technological 
systems . ^ . 

Failures  on  the  aircraft  carrier,  are  very  critical. 

If  any  one  of  five  activities  fail  significantly,  the  ship 
can  be  disabled  by  fire  or  explosions,  many  men  killed,  very 
valuable  equipment  lost  irretrievably  and  in  the  nuclear 
areas  a  major  ecological  and  human  catastrophe . 

The  degrees  of  interdependence  among  functional  units 
within  these  organizations  [is  also  important .] 2 ... .  On  the 
carrier  there  is  intensive,  often  face-to-face,  reciprocal 
Interdependence  among  those  carrying  out  air  operations 
planning  and  missions.  A  third  [property]  is  also 
instructive  -  the  degree  to  which  the  operating  technology 
impels,  indeed,  substitutes  for  coordination 
relationships....  (T]he  units  involved  in  air  operations 
aboard  an  aircraft  carrier  are  [not  so]  technologically 
tightly-coupled  to  each  other.  The  technologies  specific  to 
individual  functions,  e.g.,  catapult,  arresting  gear, 
landing  signal  operations,  and  foul  weather  radar,  are  each 
as  tightly  coupled  as  for  the  ATC,  but  their  necessary 
coordination  is  not  "hardwired"  at  all.  This  depends  almosc 
wholly  on  often  continuous,  face-to-face/phone-to-phone 
contacts  and  negotiations  among  senior  crewmen  and  officers. 


Requisites  for  High  ReliaUaility  Organizations 

Strong  challenges  to  public  and/or  corporate  policies 
arise  when  on-going  or  proposed  programs  require  large 
scale,  knowledge  intensive  organizations,  and  the 
consequences  of  operational  failures  are  very  costly. 
Technological  deployers  and  regulators  strive:  to  improve 
policies  in  situations  where  trial  and  error  learning  is  of 
diminished  utility;  to  achieve  nearly  failure-free 
operations  of  large,  complex  public  and  industrial 
organizations;  and  to  design  effective  regulatory  units 
charged  with  overseeing  such  operations.  In  effect, 
operational  reliability  rivals  short-term  efficiency  as  a 
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dominant  organizational  value.  The  higher  the  perceived 
hazard  or  costliness  of  failures,  the  more  insistent  the 
demands  for  operational  reliability.  Nearly  failure-free 
operations  are  difficult  to  achieve  in  any  setting.  Within 
technically  complex,  large  scale  organizations,  these 
challenges  are  especially  severe.  Meeting  them,  or 
understanding  the  limits  of  such  efforts,  requires  more  than 
skillful  leadership  and  successful  bureaucratic  politics. 
Additional  knowledge  is  necessary. 

This  requires  a  theoretical  explication  of  the 
organizational  requisites  for  and  limitations  of  attaining 
nearly  failure-free  operations  in  large  scale  organizations; 
and  an  improved  empirical  understanding  of  the  technical, 
organizational  and  political  conditions  — and  their 
costa — that  satisfy  these  requisites. [3 ]  What  are  the 
theoretical  properties  and  empirical  conditions  associated 
with  successfully  attaining  what  appears  on  its  face  to  be  a 
nearly  impossible  requirement? 

Attaining  nearly  failure-free  organizational 
operations,  logically  entails  the  satisfaction  of  at  least 
five  pairs  of  knowledge/behavioral  conditions,  each  with 
measures  to  assure  effective  implementation. 

l.K.  Unambiguous,  nearly  complete  casual  knowledge 
concerning  the  necessary  functioning  of  the  technical 
and  organizational  system  in  order  to  assure  expected 
outcomes,  both  in  the  earlier  stages  of  development  and 
certainly  as  the  technology  reaches  operational 
maturity;  and, 

1. B.  Nearly  error-free  performance  from  both  personnel 
and  machines,  based  on  this  knowledge,  to  ensure  a 
level  of  performance  that  maintains  the  consistent 
operations  of  the  system. 

It  is  obviously  not  justified  to  assume  that  these  two 
conditions  can  be  met  without  preparing  for  unexpected 
deviations  within  the  system.  Therefore: 

2. K.  Error  regimes  specifying  the  small  deviations  from 
operational  norms  for  both  machines  and  operating 
personnel  behavior  that  signal  the  potential  onset  of 
failure  for  each  critical  component,  under  actual 
operating  conditions,  rendered  in  quantitative  terms 
and, 

2.B.  Detection  vis-a-vis  continuous  error 
identification  activities  of  people/units  charged  with 
alerting  organizational  leaders  if  critical  components 
malfunction  or  human  performance  flags.  Deviations 
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must  be  spotted,  failure  avoided  and  the  sources  of 
error  onset  repaired  or  eliminated.^ 

But  detecting  the  early  on-set  of  potential  failures  does 
not  eliminate  their  eventuality.  Therefore, 

3. K.  Improved  knowledge  of  the  character  of  failures' 
consequences,  especially  the  potential  for  the 
propagation  of  damage  and  dislocation  through  the 
system ;  and , 

3B.  "Error"  (or  failure)  absorbing  capabilities  In 
groups  organized  both  to  contain  damage  within  the 
organization,  affecting  only  those  closest  to  the 
breakdown,®  and  to  provide  “redundant  channels"  of 
operation  to  Insure  that  the  system  will  continue 
performing  despite  breakdown.^ 

With  "failure  consequence  absorbers"  in  place,  society 
might  be  assured  of  benign  operations,  particularly 
when  failures  are  relatively  limited  and  only 
moderately  costly  to  remedy.  But  as  the  capacity  of 
the  technical/organizational  enterprise  to  do  both  good 
and  111  rises,  so  does  the  urgency  of  systematic 
attention  to  the  effects  upon  the  surrounding  region  of 
significant  failures  in  the  rare  event  they  occur. 

It  is  obvious  that  many  organizations  in  modern  society, 
may  have  failures  of  such  severity  that  their  consequences 
cannot  be  contained  internally.  There  are  also  two 
requisites  for  sensing  the  onset  of  and  responding  to 
failures  that  spill  outside  of  the  organization  parallel  to 
those  just  listed  for  Internal  operations. 

4. K.  Credible,  exact  knowledge  of  the  effects  of  the 
technical  operations  upon  the  biological,  environmental 
and  social  world,  necessary  to  establish  a  firm  basis 
for  judging  the  full  range  of  benefits  and  costs  of 
these  operations;  and, 

4.B.  A  continuous  monitoring  capability  so  that  the 
distribution  of  external  effects  may  be  detected  as  the 
technology  spreads  and  "ages."  This  requires  the 
institutionalization  of  expert  groups  holding  the 
skills  necessary  to  identify  the  changes  in  areas 
proximate  to  and  caused  by  malfunctions  of  the 
technical  system. 

For  systems  seen  as  potentially  the  cause  of  great 
harm,  it  is  unlikely  that  the  public  will  be  assured  that 
continuous  failure-free  performance  will  be  forthcoming  due 
to  efforts  of  the  operators  alone.  Therefore,  the  final 
requisites: 
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5.K.  Unambiguous  "system  error"  specification  regimes 
cast  in  terms  of  those  conditions  tne  public  is  seeking 
to  enhance  or  avoid;  and 

5.B.  Highly  effective,  continuously  ready  organizations 
alert  to  the  commission  of  "system  errors"  and  prepared 
to  take  immediate  steps  to  contain  their  consequences. 


The  logical  knowledge  requisites  listed  above  have  the 
ring  of  an  engineering  view  of  the  situation,  i.e., 
specifying  the  information  necessary  for  "closing  the 
system,"  then  applying  more  technical  solutions  to  areas  of 
uncertainty.  The  implicit  "sociologic"  is  that  human  groups 
will  be  able  to  operate  the  technical  systems  at  the  level 
of  relied>ility  necessary  to  deliver  their  benefits.  When 
each  knowledge  requisite  is  paired  with  its  behavioral  mate, 
the  magnitude  of  the  demand  becomes  more  apparent. 

The  requisites  for  seeking  perfection  in  organizational 
performance  would  be  very  stringent  for  any  technical  or 
organizational  system.  They  are  particularly  rigorous  for 
organizations  that  have  increased  rapidly  in  size  and 
Internal  complexity,  and  which  face  considerable  public 
anxiety  about  the  consequences  of  failures. 

A  growing  number  of  organizations  confront  these 
conditions.  Some  of  them  continue  to  achieve  an  enviable 
record  of  reliable  performance.  How  many  are  facing 
additional  changes  -  in  technical  design,  organizational 
scale  and  internal  operations  -  that  will  substantially 
increase  the  challenge.  Yet  the  organizational  and 
institutional  means  and  social  relations  necessary  to 
realize  these  requisites  are  scantily  understood. 


Limitations  of  Current  Literature. 

Organization  theoretic  and  management  literatures  are 
silent  regarding  such  extraordinary  requirements.^  They  are 
literatures  based  almost  exclusively  on  experience  with 
organizations,  mainly  in  the  private  sector:  1)  that  are 
"loosely  coupled"  within  and  with  their  environments, 

(hence,  the  effects  of  operational  failure  rarely  propagate 
much  beyond  the  unit  causing  it;)®  t.)  whose  internal 

dynamics  appear  increasingly  characterized  by  coalition 
formation  and  "political  behavior,"  where  organizational 
goals  and  strategies  are  likely  to  be  contested  and  where 
compromise,  as  well  as  more  traditional  analytical  methods, 
play  a  major  role  in  decision-  taking;^®  3)  whose  decision 
processes  can  be  characterized  as  "incremental,"  trial  and 


error,  and  sonetines  as  "organized  anarchies,"  where  groups 
with  problem  solutions  seek  those  with  problems  to  solve 
and  4)  where  failures  of  task  technologies,  though  perhaps 
costly  to  replace,  do  not  threaten  the  organization's 
existence  or  capacity  to  provide  service. 

Such  organizations  are.  In  a  sense,  "failure  tolerant;" 
decision-  making  and  policy  improvements  can  be  confidently 
based  on  incremental,  trial  and  error  procedures,  where  the 
value  of  the  lessons  learned  from  making  an  error  Is  greater 
than  Its  cost.  And  Importantly,  there  Is  at  least  the  tacit 
expectation  that  If  some  actually  fall  badly  -  and  dissolve 
-  that  the  goods  and  services  they  provided  would  be 
furnished  by  competitors. 

If  organizational  reliability  Is  cast  in  terms  of 
Improvement  In  Individual  performance,  some  guidance  can  be 
derived  from  the  literature.  Increases  In  reliability  of 
performance  follows  from:  high  levels  of  formalization  with 
explicit  and  specific  definitions  of  rules  and  roles; 
cybernetic  controls  that  provide  feedback  loops  that  convey 
timely  Information  on  performance  values  to  performers  and 
to  their  supervisors;  "stable  sub-assemblies",  l.e.,  units 
capable  of  retaining  their  form  and  performing  their 
functions  without  constant  attention  from  superior  units; 
strong  organizational  culture  with  shared  cognitive  and 
normative  beliefs  and  common  commitments  to  goals  and  ways 
of  working;  great  attention  to  personnel  selection  and 
training;  and  the  greater  the  technical  and  environmental 
uncertainties  that  more  flexible  the  work  system  and 
organizational  bu;:fers.l2  These  properties  and 
relationships  are  posed  with  an  Implicit  perspective  of 
performance  that  is  middling  and  needs  Improving  somewhat 
rather  than  for  situations  in  which  failure  free  performance 
Is  stressed. 


The  Conceptual  Challenge  of  High  Reliability  Organizations. 

The  organizations  that  Interest  us  fall  Into  an  unusual 
category:  they  provide  Important  public  services  which 
Include  operating  for  periods  of  very  high  peak  demands; 
failures  of  their  task/production  technology  can  be 
catastrophic;  trial  and  error  learning  In  some  areas  seems  a 
risky  business;  and  the  costs  of  major  failures  appear 
potentially  much  greater  than  the  lessons  learned  from  them. 
In  organizations  with  these  characteristics,  what  structural 
and  behavioral  patterns  have  evolved  that  are  associated 
with  extraordinarily  high  levels  of  reliable  performance  and 
enable  them  to  realize  the  demanding  requisites  of  "nearly 
failure-free"  management? 


In  addrassing  this  question,  we  assume  that  the 
character  of  the  physical  technologies  serves  strongly  to 
shape  a)  the  particular  organizational  forms,  behaviors  and 
effort  (in  resources  and  information)  necessary  to  operate 
them,  b)  the  character  of  the  coordination  and  control 
dynamics,  particularly  in  the  face  of  expected  but 
specifically  unpredictable  heavy  demands  on  operators,  and 
c)  the  public  and  organizational  insistence  that  failures  be 
avoided  altogether.  This  suggests  that  organizations  are 
composed  of  a  technical  core,  a  managerial  level  that 
coordinates  activities  among  technical  units  and  between 
them  and  an  institutional  level  concerned  mainly  with 
anticipating,  absorbing,  and  potentially  shaping  the  demands 
thrust  upon  the  organization  by  elements  in  its 
environment.^^  And  we  view  high  reliability  organizations 
as  open,  rational  systems  with  considerable  reenforcement  to 
behave  like  closed  rational  ones.  At  the  work  group  level, 
we  draw  on  conceptions  of  the  dynamics  of  soclo-technical 
systems,  the  rule  making  and  following  nature  of 
organizational  behavior,  organizational  culture,  and 
"negotiated  order. 

High  reliability  organizations,  then,  can  be 
characterized  roughly  as  composed  of  three  overlapping 
communities:  operators,  manager/coordinators,  and  senior 
executives  together  attempting  to  maintain  conditions 
enabling  1)  hazardous  operations  to  be  carried  on 
continually  at  high  levels  of  capacity,  2)  safely  with  3) 
the  capability  to  adjust  flexibly  to  peaked  demands  and 
surprises  from  their  external  (Institutional)  environments. 
Thus,  their  main  operating  problems  are  twofold:  to  manage 
complex,  demanding  technologies  making  sure  to  avoid  major 
failures  which  could  cripple,  perhaps  destroy,  the 
organization;  and,  at  the  same  time,  to  maintain  the 
capacity  for  meeting  intermittent,  somewhat  unpredictable, 
periods  of  very  high  peak  production,  e.g.,  ...  maximum  air 
operations.  A  pervasive  operating  tension  emanates  from  the 
pressures  from  top  management  to  commit  the  organization  to 
high  levels  of  performance,  and  senior  operating  officials' 
insistence  on  investing  in  systems  and  processes  which 
enhance  reliability  (and  safety)  in  the  face  of  unexpected 
operating  conditions.  Each  community  shares  much  the  same 
goals,  but  their  emphases  are  likely  to  differ  as  a  function 
of  their  "proximity”  to  the  technical  operations  per  se  and 
the  scope  and  irreversibility  of  failures'  consequences.  ... 


In  returning  to  the  central  questions  posed  at  the 
outset  of  this  Section,  the  challenge  is  to  discover  the 
effects  on  the  familiar  patterns  of  complex,  technical 
organizations  occasioned  by  the  perception  that  significant 
failure  in  day-to-day  operations  could  have  potentially 
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catastrophic  consequences.  Four  of  the  six  sets  of 
questions  (sets  2-5)  outlined  above  are  taken  up.  They 
require  attention  before  the  evolutionary  or  design 
questions  can  be  addressed  confidently. 


Structural  Patterns  and  the  Nanageaent  of  Interdependence. 

What  patterns  of  formal  structure  and  rules  have  developed 
In  response  to  the  requirements  of  very  reliable 
performance?  This  question  would  be  reasonably 
straightforward  for  the  usual,  failure-tolerant 
organization.  There  Is  agreement  on  both  the  goals  and 
means,  the  core  technologies  are  well  known.  This  is  the 
classical  situation  for  bureaucratic,  hierarchical  structure 
and  formal  processes. But  these  expectations  tacitly 
assume  that  errors  In  the  production  processes  are  not 
likely  to  be  large;  trial  and  error  learning  can  be  the 
order  of  the  day. 

In  high  reliability  organizations,  reliability-oriented 
allocation  of  responsibilities  and  control  pr?.;e5ses  compete 
with  production-oriented  ones.****  What  divisions  of 
responsibility  and  distributions  of  formal  authority  emerge? 
To  what  degree  is  command  responsibility  vested  mainly  "at 
the  center"  as  contrasted  to  its  distribution  on  the  basis 
of  critical  function?  Do  leaders  of  the  units  requiring 
reliability,  or  seeking  to  assure  it  in  other  units,  take 
places  formally  in  the  "dominate  coalition"  of  the 
organization,  as  expected  by  the  contingency  theorlsts?^^ 
What  are  the  formal  relations  between  the  technically 
skilled,  reliability-oriented  groups  and  leaders,  usually  in 
higher  status  positions,  charged  with  coordination  and 
strategic  direction? 

HY  1.1:  As  the  severity  of  potential  failure  increases; 
the  more  likely  the  units  directly  involved  will  have 
formal  representatives  in  "ruling  coalition;"  the  most 
likely  centralized  authority  structures  will  be 


****  We  have  not  emphasized  pressures  due  to  demands 
for  operating  efficiency,  a  problem  for  most  modern 
organizations.  Until  recently,  high  reliability 
organizations  have  operated  with  only  a  moderate  concern  for 
short-texm  efficiency.  Their  social  function  has  been  so 
important  that  effectiveness  and  reliabilxcy,  even  at 
substantial  cost,  that  cost  cutting  measures  have  taken  a 
backseat.  The  internal  dynamics  prompted  by  continued 
resource  constraints  is  an  important  topic  for  subsequent 
research. 
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moderated  by  formal  and  informal  delegation  of  critical 
oversight  to  the  units  directly  involved;  and  the  more 
likely  the  implementation  of  harsh  penalties  for  those 
formally  responsible  for  the  organization  and  the 
directly  involved  units.  [P:1.B,  2.B]***** 

Complex  operating  technologies  tend  to  increase  the 
interdependencies  within  and  among  operating 
organizations.^'  In  high  reliability  organizations, 
parallel,  often  redundant,  sets  of  complex  communication  and 
control  technologies  are  also  evident. Interdependencies 
of  control  overlay  those  of  production.  Each  type  exerts 
varied  demands  for  watchfulness  and  interaction  on  operators 
and  managers.  What  are  the  patterns  of  interdependencies 
associated  with  units  requiring  reliability,  and  what 
processes  have  emerged  to  coordinate  and  manage  them  in 
meeting  the  dual  demands  of  reliability  and  peak  loads? 

HY  1.2:  As  the  operating  technologies  become  more 
functionally  interdependent:  the  more  fully  formal  and 
informal  mechanisms  of  communication  and  coordination 
develop  and  overlay  those  of  production;  the  more 
dense  the  channels  of  horizontal  communication  and  the 
mere  frequent  collegial  authority  processes;  and  the 
more  likely  the  development  of  formal  norms  of 
intervention  in  the  production  process  from  members 
having  functional  knowledge  regardless  of  their 
organizational  status.  (P:2.B,  3.B] 

An  aircraft  carrier  and  its  air  wing,  for  example,  are 
each  highly  interdependent  operating  units.  For  effective 
operations,  they  must  somehow  mesh  during  periods  of  maximum 
readiness,  yet  they  are  independent  units  during  the  times 
when  the  ship  is  in  home  port.  They  must  manage  a  kind  of 
organizational  "quick  connect  and  disconnect"  -  rapidly 
integrating  some  2800  men  and  support  machines  for  90 
aircraft  into  an  ongoing  ship  of  3000,  then  disconnect  again 
for  training  "on  the  beach,"  without  incurring  damage  to 
either  group.  And,  during  "at-sea"  periods,  reliable 
operations  require  activities  that  assure  rapid  adjustment 
to  changes  in  tactical  missions,  aircraft  status  and  sea 
conditions,  and  assure  accuracy  of  communications  and  safety 
information  during  the  critical  launch  and  recovery 
(landing)  periods.  ... 

Such  organizations'  formal  structure  is  designed  to 
facilitate  hierarchical  direction  and  coordination;  each  has 


*****  Bracketed  numbers,  e.g.,  [P:  l.B),  the  indicates 
the  reliability  requisite  noted  above  to  which  the 
hypothesis  is  related. 
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developed  formal  structures  of  reliability  assuring  units 
and  processes,  as  well.  Due  to  the  demands  Imposed  by 
sophisticated  technologies,  it  is  likely  that  there  will  be 
patterns  of  "horizontal,  collegial"  relationships  of  varying 
intensity  and  formal  intent  among  Interdependent,  high 
reliability  units.  These  patterns  of  cross-cutting 
authority  relationships  can  be  described  and  compared,  in 
part,  examining  the  degree  to  which  they  are  formally  or 
informally  designed  and  operated. 


Decision  Kaking  in  High  Deaand/High  Reliability  Conditions. 

Research  on  decision-making  in  large  organizations  has  been 
rooted  in  some  notion  of  technical  rationality,  the  attempt 
to  optimize  some  value,  within  the  limits  of  human  cognitive 
capabilities  and  perceptual  biases. Studies  of  the 
reactions  of  decision-makers  to  contingencies,  where 
attaining  optimality  is  problematic  due  to  analytic 
complexity  and  uncertainty,  reveal  decision-makers  as 
"satisflers. Incremental,  trial  and  error  learning  is 
the  predominate,  and  recommended,  behavior;  strong 
dependence  on  comprehensive  planning  is  criticized  as  a 
strategy  leading  to  failures  more  grievous  than  the  errors 
resulting  from  pragmatic  trials.  Both  these  descriptions, 
and  coping  behaviors  observed,  involve  accepting  the 
consequences  of  error  and  suboptimization  and  decisions  of 
only  moderate  quality  -  the  "best  one  can  do. "22  Demands 
for  reliability,  the  irreversibility  of  processes,  the  high 
cost  of  system  failure,  and  the  difficulty  of  decisions  that 
achieve  failure-free  results,  pose  analytical  and 
descriptive  problems  that  strongly  challenge  the  traditional 
literature.  Much  of  it  has  only  marginal  relevance  to  the 
operation  of  high  reliability  organizations. 

When  failures  are  fatal,  knowledge  of  the  system  and 
its  behavior  is  valued:  the  more  complete  the  better. 
Comprehensive  analysis  is  sought  even  if  completeness  is 
impossible.  What  are  the  processes  through  which  the 
technologies  are  exhaustively  learned  and  that  learning 
shared,  corrected  and  expanded?  What  decision  making  and 
communication  dynamics  characterize  the  processes  of 
day-to-day  planning  and  operation  when  failures  are  very 
costly,  maximum  performance  may  be  required,  and 
contingencies  are  expected  but  their  specifics  are 
unpredictable?  How  are  the  constraints  inevitably  imposed 
by  formal  structure  overcome,  especially  in  confronting 
those  activities  from  which  unacceptable  failures  may 
ari8e?23 

HY  2.1:  As  the  severity  of  potential  failure  increases: 

the  more  insistence  on  complete  formalization  of 
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daclsion  rules  related  to  technical  apparatus;  the 
greater  the  pressure  from  hierarchies  on  subordinates 
for  assurances  of  maxlmun  performance  without  failure, 
and  the  greater  the  expressed  need  from  managerial 
subordinates  for  discretion  In  doing  their  work. 

[Prl.K,  l.B,  2.B] 

As  conditions  became  critical,  communication  and 
decision  making  patterns  are  expected  to  cross  formal 
channels. 24  jf  they  do,  the  extent  of  such  informal 
relations,  and  the  degree  of  negotiations  (almost  continuous 
In  the  Navy  case)  between  and  across  formal  status  levels 
should  be  chartered.  Similarly,  the  structure  of 
Information  redundancy  for  purposes  of  maintaining 
Independent  sources  and  for  accuracy  checks  should  be 

outlined. 25 

HY  2.2:  Within  a  system  of  highly  specific  rules  of 
technical  operations  and  reporting  relationships,  as 
the  degree  of  uncertainty  about  external  demands 
Increases:  wUi  more  likely  conflict  will  occur 
concerning  the  degree  to  which  such  rules  or  reporting 
relationships  are  inappropriately  applied;  the  more 
likely  the  sense  of  ambiguity  and  fear  expressed  by 
responsible  sxibordinates ;  and  more  likely  responsible 
subordinates  will  act  informally  to  compensate  for  what 
they  perceive  to  be  inappropriate  or  dangerous  rules, 
procedures  or  directives  from  higher  authority.  (P:2.B, 
3.B] 

In  observations  with  the  carrier,  our  team  followed  the 
conflicts  that  cascaded  from  the  Carrier  Group  Commander,  an 
Admiral,  through  the  ship's  Captain,  and  his  Operation 
Officer  and  spread  out  to  involve  the  Air  Boss  (tower) ,  the 
Aircraft  (Deck)  Handling  Officer,  the  Operations  Officers  of 
the  Air  Wing,  and  three  Squadrons  when  an  order  came  at  8pm 
for  a  4am  mission  the  next  day.  It  was  to  carry  out  a 
mission  no  one  but  the  Admiral  and  his  staff  believed  was 
worth  the  disruption  of  prior  plans  and  was  expected  to 
greatly  increase  the  risk  to  pilots.  Pressures  mounted 
through  the  chain  of  command,  increasing  the  stress  on  the 
operating  units.  This  was  especially  felt  by  the  aircraft 
handler,  who  believed  attempting  the  mission  as  desired 
would  put  his  people  at  even  greater  risk  than  usual. 

Several  sharp  encounters  sessions  occurred  revealing  a 
pattern  negotiation  and  interaction  quite  different  from  the 
apparent  chain  of  command.  The  Admiral  prevailed,  finally, 
after  a  series  of  compromises  were  struck. 

Tracking  the  networks  of  interdependence  that 
characterize  these  organizations  provide  clear  research 
oppor .unities.  They  also  drive  up  the  necessary  research 
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effort.  Decisions  and  actions  within  these  networks  often 
trigger  interactions  that  spread  quick] y  through  different 
units  usually  dispersed  across  the  system.  The  most 
interesting  evolutions  ->  the  patterns  of  reactions  to  the 
potential  onset  of  crises  ->  happen  with  astonishing  speed. 

To  capture  the  dynamics  requires  the  presence  of  a  well 
trained  and  experienced  team  coordinating  their  observations 
simultaneously  from  different  "locations.” 


The  "Organizational  Culture*  of  High  Reliability. 

These  organizations  present  operators  with  substantial 
challenges  and  very  demanding  circumstances.  Successes  and 
failures  are  consecpiential .  Individuals'  involvement  is 
seen  as  efficacious,  if  risks  are  met  and  overcome; 
foolhardy,  if  skills  are  wanting  and  working  conditions 
risky.  Full  knowledge  of  the  processes  and  high  motivation 
to  carry  them  out  are  requisites  for  reliability.  But 
formal  structure  and  rules  (SOP's) ,  or  informal  operating 
rules,  rarely  provide  sufficient  guides  for  behavior  to 
account  for  all  the  technical  and  cooperative  skills  or 
motivations  necessary  for  effective  performance.  These 
"gaps”  are  filled  variously  in  the  development  of  an 
organization's  culture. 26 

In  "high  reliability"  organizations,  the  substance  of 
this  culture  is  likely  to  be  crucial  for  effective 
operation.  What  group  norms  are  evident  within  and  between 
units  requiring  reliability  concerning  relations  with  and 
obligations  to  group  members  and  to  the  organization  as  a 
whole?  This  question  is  perhaps  the  most  difficult  and  most 
important  of  the  several  research  areas.  When  one  observes 
the  operators  in  these  organizations  for  any  length  of  time, 
one  wonders  why  they  would  subject  themselves  to  the  rigors 
and  hazards  inherent  in  these  jobs  and  processes.  Why  they 
do,  the  norms  they  come  accept  about  their  behavior,  and  the 
conditions  which  sustain  them  are  important,  and  unknown. 

HY  3.1:  As  the  severity  of  potential  failure 
increases:  the  more  likely  formal  and  informal 
(on-the-job)  training  will  intensify,  and  include 
pressures  for  new  members  to  accept  attitudes  that 
legitimate  self-sacrificing  behavior  and  a  sense  of 
personal  responsibility  for  the  welfare  of  the  whole 
working  <7roup.  (P:1:B,  2.B,  3.B) 

Top  technical  operators  and  upper-middle  level  managers 
struggle  to  develop  and  maintain  norms  among  their  workers 
that  facilitate  both  ability  for  limited  periods  of  maximum 
performance  and  long  term,  highly  reliable  performance.  Due 
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to  the  different  operational  demands  of  various 
sub'organizations,  we  expect  variations  among  the  sub¬ 
groups.  Successful  "high  reliability”  organizations  have 
somehow  been  able  to  stimulate  high  commitment  and  intense 
effort  from  operators.  Our  initial  work  suggests  that 
members  of  high  reliability  groups  develop  a  sense  of  trust 
in  group  members  and  take  on  an  obligation  of  collective 
responsibility  for  each  other. 

HY  3.2:  As  tensions  between  the  requirements  for 
stable  technical  operations  and  flexible  responses  to 
unexpected  peaked  demands  and  surprise  increase  (due  in 
part  to  perceived  increases  in  the  magnitude  of 
failures'  consequences,):  organizational  norms  of 
submission  to  rules  AND  to  ignore  them  intensify;  and 
informal  norms  develop  that  specify  what  situations 
warrant  challenges  to  authority  and  moderate  the 
application  of  sanctions  in  formal 
evaluation/ inspection  processes.  [P:2.B,  3.B] 


The  Promise  of  New  Technologies. 

High  reliability  organizations  aro  the  objects  of  efforts  to 
introduce  new  technologies,  often  computer-based.  These  are 
promoted  as  a  solution  to  the  joint  demands  of  increased 
performance,  maintenance  of  safety  and  reliability,  and 
competition  for  scarce  resources.  Faced  with  the  prospect 
of  budget  reductions,  or  nearly  constant  budget  levels,  many 
high  reliability  organizations  are  nevertheless  pressured  by 
management  to  increase  operational  capacity  and  efficiency. 
Yet,  the  social  environment  remains  as  intolerant  of  major 
failures  as  before,  holding  the  organization  to  an  absolute 
standard  that  effectively  requires  an  increase  in  safety 
levels  per  unit  operation. 

Under  such  circumstances,  it  is  perhaps  not  surprising 
that  the  use  of  computer-assisted  decision  technologies  in  a 
variety  of  forms  has  been  the  subject  of  intense  discussion 
in  each  of  the  organizations  we  are  studying.  ...[T]he 
development  of  the  U.S.S.  Carl  Vinson  involved  a  variety  of 
on-board  experimental  computer  systems  designed  to  aid  and 
augment  planning  as  well  as  operational  functions.  ^”7 

Operators  generally  welcome  the  idea  of  beneficial 
change.  Many  high  reliability  organizations  are  highly 
technical,  and  in  the  past  they  have  themselves  initiated  a 
good  deal  of  innovation.  Yet,  they  remain  wary  of  the  new 
computer-aided  technologies,  particularly  those  that  are 
intended  supplement  or  supplant  the  human  operator  in  any 
dimension  rather  than  simply  augmenting  or  facilitating  the 
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flow  and  integration  of  information. 

Selecting  a  variety  of  high  reliability  organizations 
with  a  variety  of  circumstances  in  design,  plan,  and 
implementation  of  new  technologies  enable  us  to  ask  a 
variety  of  questions  about  their  effects.  To  what  degree  is 
a  trend  towards  automating  or  replacing  operators'  judgments 
being  considered?  How  and  where  is  it  being  tried  or 
Implemented?  How  are  operators  reacting,  and  how  much  input 
do  they  have  to  the  process  of  innovation?  what  are  their 
expectations  of  problems  as  well  as  benefits,  and  on  what 
experience  is  this  based? 

HY  4.1:  As  the  severity  of  potential  failure  increases: 
so  does  resistance  to  the  replacement  of  a  traditional 
technology  or  technique  by  an  advanced  technology 
unless,  in  the  long  term  operation  of  the  technology, 
greater  reliability  can  be  demonstrated  in  situations 
which  are  perceive  to  be  associated  with  the  early 
onset  of  operational  failures.  2.B] 

This  is  another  area  where  the  Interaction  between  the 
researchers  and  operators  produces  far  more  than  either 
could  achieve  separately.  Operators  often  have  no  language 
to  describe  their  concerns.  These  are  often  based  on 
perceived  aspects  of  organizational  design  and  complexity 
that  contribute  critically  to  safety,  yet  have  never  been 
formally  described  or  analyzed.  The  research  team  has  the 
language,  but  only  through  the  closest  continual  interaction 
with  operators  in  real-time  conditions  can  the  empirics  of 
each  situation  be  discerned. 

Of  particular  Interest  are  cases  where  new  technologies 
are  mixed  with  traditional  ones  of  proven  reliability  in 
actual  day-to-day  activities. Experience  shows  that 
technologies  said  to  offer  increased  flexibility  often 
impose  instead  new  constraints  to  facilitate  their 
operation.  Technologies  designed  to  reduce  operator 
workload  can  instead  increase  demand  for  throughput,  so  that 
operator  loads  Increase  once  again,  while  the  margin  for 
recovery  if  the  new  technology  should  fall  goes  down. 29  For 
ordinary,  failure-tolerant  systems  these  are  treated  as 
"side- 

effects".  For  the  systems  the  interest  us,  they  are 
crucial.  What  other  surprises  might  lie  in  store  for  future 
new  technologies?  To  what  extent  are  operators  aware  of 
and  sensitive  to  the  potential  for  surprise?  What  actions, 
if  any,  can  they  or  the  organization  take  to  exert  some 
control? 

HY  4B:  The  greater  the  supporting  infrastructure  and 
relative  increase  in  required  operational  knowledge 


required  to  operate  a  technical  innovation,  the  more 
likely  its  implementation  will  require  substantial 
workgroup  and  organizational  re-structuring,  and,  if 
implemented,  the  more  likely  the  degradation  of  high 
reliability  activities.  (The  time  to  recovery  of 
initial  reliable  performance  is  indeterminant.) 
[P:1.K,  l.B,  2.K.,  2.B,  3.K,  3.B] 


Concluding  Comments 

Generalizing  on  the  basis  of  both  theoretic  reflection 
and  a  limited  amount  of  empirical  observation,  "high 
reliability  organizations"  that  pose  the  most  Interesting 
intellect'*'  ^nd  operational/policy  challenges  have  the 
following  *  iracteristics:  [Organizations  demonstrating  very 
high  levels  jf  operational  reliability  are  likely  to  have 
the  following  characteristics:] 

—  They  have  a  strong,  reasonably  concrete  sense  of  their 
primary  missions,  operational  goals  and  the  technical  means 
necessary  to  accomplish  them. 

—  All  operate  quite  powerful,  knowledge  intensive 
technologies  with  very  few  significant  operational  failures. 
These  technical  systems  are  well  known;  their  mechanisms  and 
processes  can  be  nearly  completely  specified. 

—Their  major  production  units,  e.g.,  power  station,  ATC 
center,  or  naval  vessel,  are  quite  complex  and  linked 
together,  often  in  large,  tightly  coupled  operating 
networks,  e.g.,  power  grid,  national  system,  or  task  force, 
that  strongly  effects  levels  of  internal  operating  strains 
and  the  capacity  to  adjust  to  surprise. 

—  They  manage  activities  for  which  external  or  internal 
consequences  of  failure  are  perceived  to  be  great.  The  rare 
operational  failure  gravely  threatens  the  organization's 
capacity  to  operate,  to  deliver  crucial  services,  and/or 
threatens  the  lives  of  its  members  or  those  of  the  community 
at  large. 

—  Recently,  such  organizations  have  seen  their  workloads 
increase  while  their  resources  bases  have  been  in  relative 
decline;  as  a  result,  an  additional  level  of  sustained 
stress  has  been  added  to  the  amount  of  stress  operators  are 
expected  to  absorb  in  highly  responsible  time-urgent  jobs, 
calling  for  maintaining  2d>8olute  performance  levels,  in  the 
face  of  increasing  magnitude  and  complexity  of  the  tasks. 

—  Computers  and  other  technical  systems  are  used,  often 
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extensively,  but  primarily  as  sources  of  Information  and 
data  —  inputs  to  human  judgment.  And  recently  such 
organizations  have  been  pressed  to  turn  to  new  computer 
technologies  in  the  hope  of  Increasing  their  operational 
capacity  without  directly  altering  organizational  size  or 
structure . 


Somewhat  more  speculatively: 

—  Organizational  structures,  authority  relationships,  and 
decision-  making  dynamics  appear  to  have  evolved  in  common 
patterns:  there  is  clear  separation  of  operations  from 
system  maintenance,  substantial  delegation  of  operating 
authority  to  subordinate  units,  and  redundant  information 
sources  to  inform  decision-making. 

—  Despite  the  diversity  of  their  tasks,  operators  in  each 
system  have  similar  working  environments,  share  similar 
responsibilities,  expectations,  objectives,  and  goals,  and 
show  similar  manifestations  of  the  stress  of  their  jobs. 

—  Their  operating  "cultures"  are  strongly  failure  averse. 
Internal  dynamics  and  structures  are  predominantly 
influenced  by  consistent  efforts  to  eliminate  certain  types 
of  events,  accidents  or  failures  altogether. 
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Part  3.  Methodological  Considerations. 

The  high  reliability  organizations  In  this  project  are 
extraordinarily  complex,  tightly  coupled  systems.  They 
operate  technical  systems  that  require  continual  attention 
lest  they  malfunction  and  result  in  grievous  consequences. 
They  prompt  public  concern,  sometimes  media  watchfulness, 
and  occasionally  fears  for  the  national  security.  And  there 
are  no  earlier  studies  of  these  types  of  organizations,  no 
study  guidelines  nor  tested  data  collection  instruments. 
These  conditions  suggest  both  considerable  potential  for 
advance  and  substantial  pressures  on  researchers  both  in 
sorting  out  the  research  problem  and  in  carrying  out 
in>depth  research. 

The  modem  aircraft  carrier  battle  group  (BG)  extreme 
expression  of  this  combination.  There  is  no  prior  work  on 
the  internal  dynamics  of  carriers  engaged  in  flight 
operations  at  sea;  none  on  the  relations  between  elements  on 
the  ship  or  within  the  Group.  Due  to  the  sensitive  nature 
of  BG  operations,  the  highly  classified  status  of  some  the 
weapon  systems,  and  the  demanding  nature  of  the  nuclear 
propulsion  plants,  there  is  a  deep  seated  reserve  about 
allowing  non-  Navy  people  on  board  for  extended  periods  of 
time.  Finally,  the  intensive  nature  of  organizational 
interactions,  particularly  during  fully  developed  flight 
operation,  present  phenomena  that  overwhelm  the  naive 
observer  with  '’buzzing  confusion."  This  is  a  situation  in 
which  the  researcher  could  become  "part  of  the  problem"  if 
hazardous  conditions  arise.  Yet  these  times  are  likely  to 
be  the  most  instructive  in  revealing  the  patterns  of 
relations  that  enable  such  organizations  to  respond 
effectively  to  the  onset  of  potential  failures. 

The  methodological  challenge,  then,  is  at  least  two 
fold:  initially,  to  gain  access  and  the  trust  of 
organizational  members,  and  then,  to  employ  data  collecting 
regimes  appropriate  to  the  stage  of  theoretical  development 
and  the  constraints  of  the  operating  situation. 

Access  and  establishing  legitimacy  within  the 
organization  is  addressed  is  an  early  project  paper, 
"Research  in  Nearly  Failure  Free,  High  Reliability 
Organizations:...^  ^  It  outlines  some  of  the  condition 
that  researchers  should  meet  in  order  to  do  such  research 
and  discusses  something  of  the  project  teams  perspective 
regarding  our  relationship  with  ship  and  air  wing  members. 
Suffice,  here,  to  say  that  a  central  methodological  premise 
is  that  operators/managers  in  complex  technological  systems 
have  a  deep  intuitive  sense  of  what  they  are  doing,  though 
they  may  be  unable  to  describe  precisely  how  they  do  it,  and 
are  sometimes  unaware  of  the  relational  activities  they 
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carry  out.  Researchers  are  skilled  in  description,  but 
naive  about  how  these  organizations  are  run.  The  result  is 
a  research  strategy  in  which  the  researchers  and 
operator/managers  work  together  to  clarify  hypotheses  about 
how  nearly  failure  free  operations  are  carried  out.  The 
rest  of  this  section  reviews  the  means  used  to  collect  data. 

Within  the  conceptual  perspective  on  the  requisites  for 
high  reliability  organizations  outlined  above,  three  main 
substantive  themes  framed  our  data  collecting  requirements: 
patterns  of  organizational  structure  and  Interdependence, 
decision-making  dynamics  andauthority  relations,  and 
profiles  of  organizational  culture.  The  fourth  substantive 
area  -  the  effects  of  technological  change  -  drew  from 
aspects  of  each  of  these. 

Organizational  Structure  and  Interdependence.  Three 
sources  of  research  information  were  important.  Documents 
were  reviewed  for  the  formal  picture,  to  furnish  evidence  of 
performance  levels,  and  as  a  basis  for  discovering  what  is 
learned  Informally.  Most  necessary  were  Intensive,  on-site 
observation  and  interviews  with  people  occupying  important 
coordinating  (and  reliability  related)  roles  (see  decision¬ 
making  questions.)  A  self-administered  survey  instruments 
was  also  used  with  the  first  ship  and  air  wing  in  describing 
the  perceived  patterns  of  dependence  and  interdependence. 
Operational  difficulties  and  the  discovery  of  an  instrument 
problem  limited  us  that  case. 

Decision-making  dynamics  and  authority  relations.  The 
most  intensive  part  of  the  field  research,  our  primary 
research  tools  were  interviews  and  observations.  Operations 
that  must  be  failure  free  are  identified.  After  a  period  of 
familiarization  with  them  and  the  overall  functions  of  the 
organization,  c[uestions  were  developed  to  uncover  decision 
strategies  used  in  these  operations.  These  Interview  were 
supplemented  by  self -administered  questionnaires  that  invite 
respondents  to  Indicate  those  to  whom  communications  are 
sent  and  from  whom  they  are  received.^  Initially, 
typifications  of  routine  decisions  under  normal  operations 
were  made  along  with  the  network  of  people  within  the  unit 
and  across  the  organization  that  are  likely  to  be  Involved. 
At  the  same  time,  circumstances  which  prompt  high  levels  of 
stress  were  outlined. 

On-site,  at  sea  observations  of  operators/managers  were 
carried  out  during  portions  of  four  increasingly  complex 
operational  phases  of  ship  and  air  wing  training.  These 
were  focussed  on  various  critical  functions  to  verify  the 
expected  relationships  and  unexpected  surprising  ones.  With 
additional  resources  from  University  of  California, 

Berkeley,  and  the  National  Science  Foundation  made  it 
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possible  to  spent  considerable  time  on  each  ship.  This 
enabled  the  team  to  be  present  when  operational  conditions 
brought  on  the  stress  of  Incipient  failure.  This  revealed 
the  underlying  operational  norms  and  patterns  of  authority 
In  a  ways  often  muted  in  normal  tempo  operations. 

In  all,  the  research  team  spend  approximately  thirty 
(30)  working  person  weeks  at  sea  with  the  two  ships  and  air 
wings  and  numerous  In-  port  and  air  station  visits  and 
Interviewing  periods.  Over  150  Interviews  were  conducted 
with  100  different  ships 's  company  and  air  wing  personnel 
during  and  after  working  hours  on  each  ship.  Some  20  shore 
based  support  and  command  personnel  were  Interviewed  as 
well. 

Organizational  Cult\ire.  An  Important  research  task  was 
to  discover  the  profiles  of  an  organization's  cultures  of 
reliability  and  what  sustains  them.  Survey  of  elements  of 
ship's  company  and  five  air  wing  squadrons  were  administered 
tool  the  Organizational  Culture  Inventory.  This  Instrument 
of  120  items  (compressed  into  12  scales)  seeks  the  degree 
various  attitudes  are  Important  in  order  to  "fit  into  one's 
work  group."  It  treats  culture  as:  "[A]  set  of  cognitions 
shared  by  members  of  a  social  unit. . .  which  are  acquired 
through  social  learning  and  socialization  processes  exposing 
Individuals  to  a  variety  of  culture-bearing  elements.  These 
cognitions  are  acquired  through  social  learning  and 
socialization  processes  exposing  Individuals  to  a  variety  of 
culture-bearing  elements....  In  organizations,  [these] 
patterns  of  activities  and  Interactions  members  observe  and 
carry  out  (e.g.,  decision  making,  communicating)  constitute 
major  elements  of  the  organization's  structure,  making 
structure  Itself  an  Important  culture-bearing  mechanism  in  . 
organizations. 

Survey  of  those  units  in  which  high  reliability  is 
essential  were  sampled  (from  50  to  80  percent  of  their 
members)  at  a  time  when  each  ship  and  air  wing  was  in  a  peak 
state  of  readiness.  Total  returns  neared  95  percent  of  the 
1750  questionnaires  administered.  Preliminary  analyses  have 
been  completed  on  the  data  from  USS  Carl  Vinson  (CVN-70)  and 
Air  wing  15. 


Endnotes.  Section  3. 
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"A  modern  ship  of  war  is  one  of  the  most  complicated 
machines  in  existence.  It  is  filled  with  machinery  of 
various  sorts  from  one  end  to  the  other.  The  finished  ship, 
ready  for  service  is  of  great  cost  and  enormous  value  to  the 
government.  It  is  worth  nothing  unless  efficiently  handled, 
cared  for,  and  kept  in  readiness  for  immediate  service." 

Annual  Report  of  the  Secretary  of  the  Navy,  1899 

"The  job  of  this  ship  is  to  shoot  the  airplanes  off  the 
pointy  end  and  catch  them  back  on  the  blunt  end.  The  rest 
is  detail." 

Carrier  CO 

"So  you  want  to  understand  an  aircraft  carrier?  well,  just 
imagine  that  it's  a  busy  day,  and  you  shrink  San  Francisco 
Airport  to  only  one  short  runway  and  one  ramp  and  gate. 

Make  planes  take  off  and  land  at  the  same  time,  at  half  the 
present  time  interval,  rock  the  runway  from  side  to  side, 
and  require  that  everyone  who  leaves  in  the  morning  returns 
that  same  day.  Make  sure  the  equipment  is  so  close  to  the 
edge  of  the  envelope  that  it's  fragile.  Then  turn  off  the 
radar  to  avoid  detection,  impose  strict  controls  on  radios, 
fuel  the  aircraft  in  place  with  their  engines  running,  put 
an  enemy  in  the  air,  and  scatter  live  bombs  and  rockets 
around.  Now  wet  the  whole  thing  down  with  salt  water  and 
oil,  and  man  it  with  20-year  old's,  half  of  whom  have  never 
seen  an  airplane  close-up.  Oh,  and  by  the  way,  try  not  to 
kill  anyone." 

Senior  Officer,  Air  Division 

"How  does  it  work?  On  paper,  it  can't,  and  it  don't.  So 
you  try  it.  After  a  while,  you  figure  out  how  to  do  it 
right  and  keep  doing  it  that  way.  Then  we  just  get  out 
there  and  train  the  guys  to  make  it  work.  The  ones  that  get 
it  we  make  PC's.  The  rest  just  slog  through  their  time." 

Flight  Deck  Chief 

"See  that  kid?  He's  only  19  and  my  best  driver.  Every  day 
he  picks  up  40  million  dollar,  40,000  lb.  airplanes  with  an 
underpowered,  under-tract ioned  tractor  and  pushes  them  into 
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places  you'd  swear  they  never  fit.  He'd  be  a  great  parking 
lot  attendant  back  home.  'Course  he'd  have  to  get  a 
driver's  license  first.” 

Hangar  Deck  Chief 

"If  you  take  all  the  parts  of  an  F-14  and  multiply  them  by 
their  failure  probability,  there  is  no  chance  you'd  ever  get 
one  up.  We  do  it  with  mirrors.” 

Maintenance  Chief 

"Here  I'm  responsible  for  the  lives  of  my  gang.  In  civilian 
life,  I'm  the  kind  of  guy  you  wouldn't  like  to  meet  on  a 
dark  street . " 

Deck  Petty  Officer 

"The  flight  deck  terrifies  me.  I  never  feel  safe  until  I'm 
buckled  in  and  the  canopy's  down." 

Attack  Pilot 

"As  soon  as  you  learn  90%  of  your  job,  it's  time  to  move  on. 
That ' s  the  Navy  Way . " 

Junior  Officer 

"A  hundred  things  I  have  no  control  over  could  go  wrong  and 
wreck  my  career  ...  but  wherever  I  go  from  here.  I'll  never 
have  a  better  job  than  this.  ...  This  is  the  best  job  in  the 
world. " 

Carrier  CO 


Recent  studies  of  large,  formal  organizations  that 
perform  complex,  inherently  hazardous,  and  highly  technical 
tasks  under  conditions  of  tight  coupling  and  severe  time 
pressure  have  generally  concluded  that  most  will  fail 
spectacularly  at  some  point,  with  attendant  human  and  social 
costs  of  great  severity.^  The  notion  that  accidents  in 
these  systems  are  "normal",  that  is,  to  be  expected  given 
the  conditions  and  risks  of  operation,  appears  to  be  as  well 
grounded  in  experience  as  in  theory. ^  Yet,  there  are  a 
small  group  of  organizations  in  American  society  that  appear 
to  succeed  under  similar  circumstances,  performing  daily  a 
number  of  highly  complex  technical  tasks  for  which  they 
cannot  afford  to  "fail."  We  are  currently  studying  three 
unusually  salient  examples  whose  devotion  to  a  zero  rate  of 
error  is  almost  matched  by  their  performance  —  utility  grid 
management  (Pacific  Gas  &  Electric  Company) ,  air  traffic 
control,  and  flight  operations  aboard  U.S.  Navy  aircraft 
carriers. 

Of  all  activities  studied  by  our  research  group,  flight 
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oparatlons  at  saa  Is  ths  closest  to  the  "edge  of  the 
envelope"  operating  under  the  most  extreme  conditions  In 
the  least  stable  environment,  and  with  the  greatest  tension 
between  preserving  safety  and  reliability  and  attaining 
maximum  operational  efficiency.^  Both  electrical  utilities 
and  air  traffic  control  emphasize  the  Importance  of  long 
training,  careful  selection,  task  and  team  stability,  and 
cumulative  experience,  yet,  the  Navy  demonstrably  performs 
very  well  with  a  young  and  largely  inexperienced  crew,  with 
a  "management"  staff  of  officers  that  turns  over  half  Its 
complement  each  year,  and  In  a  working  environment  that  roust 
rebuild  itself  from  scratch  approximately  every  18  months. 
Such  performance  strongly  challenges  our  theoretical  under¬ 
standing  of  the  Navy  as  an  organization.  Its  training  and 
operational  processes,  and  the  problem  of  hlgh-rellablllty 
organizations  generally. 

It  will  come  as  no  surprise  to  this  audience  that  the 
Navy  has  certain  traditional  ways  of  doing  things  that 
transcend  specifics  of  missions,  ships,  or  technology.  Much 
of  what  we  have  to  report  interprets  that  which  is  "known" 
to  Naval  carrier  personnel,  yet  seldom  articulated  or 
analyzed.^  We  have  been  struck  by  the  degree  to  which  a  set 
of  highly  unusual  formal  and  Informal  rules  and 
relationships  are  "taken  for  granted",  implicitly  and 
almost  unconsciously  Incorporated  into  the  organizational 
structure  of  the  operational  Navy. 

Only  those  who  have  been  privileged  to  participate  in 
high-tempo  flight  operations  aboard  a  modern  aircraft 
carrier  at  sea  can  appreciate  the  complexity,  strain,  and 
inherent  hazard  that  underlie  seemingly  routine  day-to-day 
operations.  That  naval  personnel  come  to  take  the  situation 
as  more  or  less  routine  is  yet  another  example  of  how 
adaptable  people  are  to  even  the  most  difficult  and 
stressful  of  circumstances. 

Although  we  have  now  spent  considerable  time  aboard 
several  aircraft  carriers  in-port  and  at  sea,  our  team  of 
non-Navy  academics  retains  a  certain  distance  that  allows  us 
to  recognize  and  report  on  the  astonishing  and  unique 
organizational  structure  and  performance  of  carrier  flight 
operations.^  We  do  not  presume  that  our  limited  exposure  to 
a  few  aspects  of  operations  has  given  us  a  comprehensive 
overview.  Nevertheless,  we  have  already  been  able  to 
identify  a  set  of  causal  factors  that  we  believe  are  of 
central  importance  to  understanding  how  such  organizations 
operate . 

In  an  era  of  constant  budgetary  pressure,  the  Navy 
shares  with  other  organizations  the  need  to  defend  those 
factors  most  critical  to  maintaining  performance  without  at 


the  same  time  sacrificing  either  operational  reliability  or 
safety.  Following  many  conversations  with  Naval  personnel 
of  all  ranks,  we  are  convinced  that  the  rules  and  procedures 
that  make  up  those  factors  are  reasonably  well-known 
internally,  but  are  written  down  only  in  part,  and  generally 
not  expressed  in  a  form  that  can  be  readily  conveyed  outside 
the  confines  of  the  Navy. 

The  purpose  of  this  note  is  to  report  some  of  our  more 
relevant  findings  and  observations  to  the  Navy  community 
that  has  been  such  a  gracious  host,  to  describe  air 
operations  through  the  eyes  of  Informed,  yet  detached 
observers,  and  to  use  our  preliminary  findings  to  reflect 
upon  why  carriers  work  as  well  as  they  do. 

Self-Design  and  Self-Replication 

Aircraft  carrier  flight  operations  as  we  know  them 
today  are  as  much  a  product  of  their  history  and  continuity 
of  operation  as  of  their  design.  The  complexity  of 
operations  aboard  a  large,  modem  carrier  flying  the  latest 
aircraft  is  so  great  that  no  one,  on  or  off  the  ship,  can 
know  the  content  and  sequence  of  every  task  needed  to  make 
sure  the  aircraft  fly  safely,  reliably,  and  on  schedule.  As 
with  many  organizations  of  similar  size  and  complexity, 
tasks  are  broken  down  internally  into  smaller  and  more 
homogeneous  units  as  well  as  task-oriented  work  groups.®  in 
the  case  of  the  Navy,  the  decomposition  rules  are  often  ad- 
hoc  and  circumstantial:  some  tasks  are  organized  by 
technical  function  (Navigation,  Weapons) ,  some  by  unit 
(Squadron) ,  some  by  activity  (Handler,  Tower) ,  and  some  by 
mission  (Combat,  Strike) .  Men  may  belong  to  and  be 
evaluated  by  one  unit  (e.g.,  one  of  the  squadrons),  yet  be 
assigned  to  another  (e.g.,  aircraft  maintenance). 

In  order  to  keep  this  network  alive  and  coordinated,  it 
must  be  kept  connected  and  integrated  horizontally  (e.g., 
across  squadrons),  vertically  (from  maintenance  and  fuel  up 
through  operations) ,  and  across  command  structures  (Battle 
Group  -  Ship  -  AirWing) .  As  in  all  large  organizations, 
the  responsible  officer  or  chief  has  to  know  what  to  do  in 
each  case,  how  to  get  it  done,  who  to  report  to  and  why,  and 
how  to  coordinate  with  all  units  upon  which  he  depends  or 
who  depend  upon  him.  This  is  complicated  in  the  Navy  case 
by  the  requirement  for  many  personnel,  particularly  the  more 
senior  officers,  to  interact  on  a  regular  basis  with  those 
from  several  separate  org'^nizatlonal  hierarchies.  Each  has 
several  different  roles  to  play  depending  upon  which  of  the 
structures  is  in  effect  at  any  given  time.^ 

Furthermore,  these  organizaticnal  structures  also  shift 
in  time  to  adapt  to  varying  circumstances.  The  evolution  of 
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the  separate  units  (e.g.,  ships,  air  wing,  command 
structures) ,  and  their  integration  during  work-up  into  a 
fully-coordinated  operational  team,  for  example,  has  few 
counterparts  in  civilian  organizations.^  And  there  is  no 
civilian  counterpart  to  the  requirement  to  adapt  to  rapid 
shifts  in  role  and  authority  during  deployment  in  response 
to  changing  tactical  circumstances. 

No  armchair  designer,  even  one  with  extensive  carrier 
service,  could  sit  down  and  lay  out  all  the  relationships 
and  interdependencies,  let  alone  the  criticality  and  time 
sequence  of  all  the  individual  tasks.  Both  tasks  and 
coordination  have  evolved  through  the  incremental 
accumulation  of  experience  to  the  point  where  there  probably 
is  no  single  person  in  the  Navy  who  is  familiar  with  them 
all.^  Rather  than  going  back  to  the  Lanalev.  consider,  for 
the  moment,  the  year  1946,  when  the  fleet  retained  the  best 
and  newest  of  its  remaining  carriers,  and  had  machines  and 
crews  finely  tuned  for  the  use  of  propeller  driven,  gasoline 
fueled,  Mach  0.5  aircraft  on  a  straight  deck. 

Over  the  next  few  years,  the  straight  flight  deck  was 
to  be  replaced  with  the  angle  deck,  requiring  a  complete  re¬ 
learning  of  the  procedures  for  launch  and  recovery,  and  for 
"spotting"  aircraft  on  and  below  the  deck.  The 
Introduction  of  jet  aircraft  required  another  set  of  new 
procedures  for  launch,  recovery,  and  spotting,  and  for 
maintenance,  safety,  handling,  engine  storage  and  support, 
aircraft  servicing,  and  fueling.  The  introduction  of  the 
Fresnel  lens  landing  system  and  air  traffic  control  radar 
put  the  approach  and  landing  under  centralized,  positive  on¬ 
board  control.  And,  as  the  years  went  by,  the 
launch/approach  speed,  weight,  capability  and  complexity  of 
the  aircraft  increased  steadily,  as  did  the  capability  and 
complexity  of  electronics  of  all  kinds.  There  were  no  books 
on  the  integration  of  this  new  "hardware"  into  existing 
routines,  and  no  other  place  to  practice  it  but  at  sea;  it 
was  all  learned  on  the  job.  Moreover,  little  of  the  process 
was  written  down,  so  that  the  ship  in  operation  is  the  only 
reliable  "manual". 

For  a  variety  of  reasons,  no  two  aircraft  carriers, 
even  of  the  same  class,  are  quite  alike.  Even  if  nominally 
the  same,  as  are  the  recent  Nimitz  class  ships,  each  differs 
slightly  in  equipment,  and  develops  a  unique  personality 
during  its  shake-down  and  first  work-up  and  deployment.^® 
While  it  is  true  that  each  ship  in  made  up  of  the  same  range 
of  more  or  less  standardized  tasks  at  the  micro-level,  the 
question  of  how  to  do  the  job  right  involves  an 
understanding  of  structure  in  which  the  job  is  embedded, 
and  that  is  neither  standardized  across  ships  nor,  in  fact, 
written  dbwn  systematically  and  formally  anywhere.  If  they 
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left  the  yards  physically  different,  even  such  apparently 
simple  matters  as  spotting  aircraft  properly  on  the  deck  has 
to  be  learned  through  a  process  of  trial  and  error. 

What  Is  more,  even  the  same  formal  assignment  will  vary 
according  to  time  and  place.  Carriers  differ;  missions 
differ;  requirements  differ  from  Atlantic  to  Pacific,  and 
from  fleet  to  fleet;  ships  have  different  histories  and 
traditions,  and  different  equipment;  COs  and  Admirals  retain 
the  discretion  to  run  their  ships  and  groups  In  different 
ways  and  to  emphasize  different  aspects.  Increased 
standardization  of  carriers,  aircraft  loadings,  missions, 
tasks,  and  organizational  structure  would  be  difficult  to 
obtain,  and  perhaps  not  wlse.^^  There  Is  a  great  deal  to 
learn  in  the  Navy,  and  much  of  It  Is  only  available  on  the 
spot. 

Shore-based  school  training  for  officers  and  crew 
provides  only  basic  instruction. It  includes  a  great  deal 
about  what  needs  to  be  done  and  the  formal  rules  for  doing 
It,  but  this  only  provides  generalized  guidelines  and  a 
standardized  framework  to  smooth  the  transition  to  the  real 
job  of  performing  the  same  tasks  on  board  as  part  of  a 
complex  system.  NATOPS  and  other  written  guidelines 
represent  the  book  of  historical  errors  —  they  provide 
boundaries  to  prevent  certain  actions  known  to  have  adverse 
outcomes,  but  little  guidance  as  to  how  to  promote  optimal 
ones. 

Operations  manuals  are  full  of  detail  of  specific  tasks 
at  the  mlcro**level,  but  rarely  discuss  Integration  Into  the 
whole.  There  are  other  written  rules  or  procedures,  from 
training  manuals  through  SOPs,  that  describe  and  standardize 
the  process  of  integration.  None  of  them  explain  how  to 
make  the  whole  system  operate  smoothly,  let  alone  at  the 
level  of  performance  that  we  have  observed. It  is  in  the 
real-world  environment  of  work-ups  and  deployment,  through 
the  continual  training  and  re-training  of  officers  and  crew, 
that  the  Information  needed  for  safe  and  efficient 
operation  Is  developed,  transmitted,  and  maintained. 

Without  that  continuity,  and  without  sufficient  operational 
time  at  sea,  both  effectiveness  and  safety  would  suffer. 

Moreover,  the  organization  is  not  stable  over  time. 
Every  40  months  or  so  there  is  an  almost  100%  turnover  of 
the  crew,  and  all  of  the  officers  will  have  rotated  through 
and  gone  on  to  other  duty.  .  Yet,  the  ship  remains  functional 
at  a  high  level.  The  Navy  itself  is  of  course  the 
underlying  structural  determinant.  Uniforms,  rank,  rules 
and  regulations,  codes  of  conduct,  and  specialized 
languages  provide  a  world  of  extensive  codification  of 
objects,  events,  situations,  and  appropriate  conduct; 


members  who  deviate  too  far  from  the  norm  become 
"foreigners"  within  their  own  culture,  and  soon  find 
themselves  outside  the  group  figuratively,  if  not 

literally . 

Behavioral  and  cultural  norms,  SOPs,  and  regulations 
are  necessary,  but  they  are  far  from  sufficient  to  preserve 
operational  structure  and  the  character  of  the  service.  We 
have  noted  three  mechanisms  that  act  to  maintain  and 
transmit  operational  factors  in  the  face  of  rapid  turnover. 
First,  and  in  some  ways  most  important,  is  the  pool  of 
senior  chiefs,  many  of  whom  have  long  service  in  their 
specialty,  and  circulate  around  similar  ships  in  the 
fleet. Second,  many  of  the  officers  and  some  of  the  crew 
will  have  at  some  time  served  on  other  carriers,  albeit  in 
other  jobs,  and  bring  to  the  ship  some  of  the  shared 
experience  of  the  entire  force.  Third,  the  process  of 
continual  rotation  and  replacement,  even  while  on 
deployment,  maintains  a  continuity  that  is  broken  only 
during  a  major  refit.  These  mechanisms  are  realized  by  a 
continuous  process  of  on-board  training  and  re-training  that 
makes  the  ship  one  huge  and  continuous  school  for  its  own 
officers  and  men. 

When  operational  continuity  is  broken  or  non-existent, 
the  effects  are  observable  and  dramatic.  One  of  us  has  had 
the  opportunity  to  observe  a  new  Niroitz  class  aircraft 
carrier  as  she  emerged  from  the  yard,  and  has  remarked  at 
how  many  things  had  to  be  learned  before  she  could  even 
begin  to  commence  serious  air  operations. Even  for  an 
older  and  more  experienced  ship  coming  out  of  an  ordinary 
refit,  the  work-up  towards  deployment  is  a  long  and  arduous 
process.  Many  operational  weeks  are  spent  just  qualifying 
the  deck  for  taking  and  handling  Individual  aircraft,  and 
many  more  at  gradually  Increasing  densities  to  perfect 
aircraft  handling  as  well  as  the  coordination  needed  for 
tight  launch  and  recovery  sequences.  With  safety  and 
reliability  as  fixed  boundary  conditions,  every  moment  of 
precious  operational  time  before  deployment  is  devoted  to 
improving  capability  and  efficiency. 

The  importance  of  adequate  work-up  time,  if  flight 
operations  are  to  be  conducted  safely  at  present  levels  of 
technical  and  operational  complexity  at  the  tempo  required 
for  demonstrating  effectiveness,  can  net  be  over¬ 
emphasized.  During  our  research,  we  followed  one  carrier 
through  a  work-up  shortened  by  "only"  two  weeks  for  reasons 
of  economy.  As  a  result,  the  ship  was  forced  ro  complete 
its  training  during  the  middle  of  a  difficult  and  demanding 
mid-ocean  exercise,  with  resulting  enormous  and  visible 
strain  on  all  hands.  Although  she  succeeded,  and  although 
referees  were  willing  to  adapt  evaluation  procedures  a  bit 


to  compensate,  risks  to  ship's  personnel,  to  the  equipment, 
and  to  the  Navy  were  visibly  higher.  Moreover,  officers 
and  crew  were  openly  unhappy  with  their  own  performance, 
with  an  attendant  and  continuing  impact  on  morale.^® 


The  p2uradox  of  High  Turnover 

Because  of  the  high  turnover  rate,  a  U.S.  aircraft 
carrier  will  begin  its  workup  with  a  large  percentage  of  new 
hands  in  the  crew,  ard  with  a  high  proportion  of  officers 
new  to  the  ship.  The  U.S.  Navy's  historical  tradition  of 
training  generalist  officers  (which  distinguishes  it  from 
all  other  military  services)  assures  that  many  of  them  will 
also  be  new  to  their  specific  jobs.  Furthermore,  tours  of 
duty  are  not  coordinated  with  ship  sailing  schedules,  so 
that  the  continual  replacement  of  experienced  with  green 
personnel,  in  critical  as  well  as  routine  jobs,  continues 
even  during  periods  of  actual  deployment. 

Continual  rotation  creates  the  potential  for  confusion 
and  uncertainty  even  in  relatively  standardized  military 
organizations.  Lewis  Sorley  has  characterized  the  effects 
of  constant  turnover  in  other  military  systems  as 
'•turbulence” ,  and  identified  it  as  prime  source  of  loss  of 
unit  cohesion. A  student  of  Army  institutional  practices 
has  remarked  that  the  constant  introduction  of  new  soldiers 
into  a  unit  just  reaching  the  level  of  competence  to  perform 
in  an  integrated  manner  can  result  in  poor  evaluations, 
restarting  the  training  cycle  and  keeping  individuals 
perpetually  frustrated  at  their  "poor"  job  performance. 

Negative  effects  in  the  Navy  case  are  similar.  It 
takes  time  and  effort  to  turn  a  collection  of  men,  even  men 
with  the  common  training  and  common  background  of  a  tightly- 
knit  peacetime  military  service,  into  a  smoothly 
functioning  operations  and  management  team.  SOPs  and  other 
formal  rules  help,  but  the  organization  must  learn  to 
function  with  minimal  dependence  upon  team  stability  and 
personal  factors.  Even  an  officer  with  special  aptitude  or 
proficiency  at  a  specific  task  may  never  perform  it  at  sea 
again. Cumulative  learning  and  improvement  are  also  made 
slow  and  difficult,  and  individual  Innovations  and  gains  are 
often  lost  to  the  system  before  they  can  be  consolidated. 

Yet,  we  regard  this  practice  to  contribute  greatly  to 
the  effectiveness  of  Naval  organizations.  Ther'.  are  two 
general  reasons  for  this  paradox.  First,  the  efforts  that 
must  be  made  to  ease  the  resulting  strain  on  the 
organization  seem  to  have  positive  effects  that  go  beyond 
the  direct  problem  they  address.  And,  second,  officers  must 
develop  authority  and  command  respect  from  those  senior 


enlisted  specialists  upon  whom  they  depend,  and  front  whom 
they  must  learn  the  specifics  of  task  performance. 

The  Navy's  training  cycle  is  perforce  dictated  by  the 
schedule  of  its  ships,  not  its  personnel.  Because  of  high 
social  costs  of  long  tours  of  sea  duty,  the  Navy  has  long 
had  to  deal  with  such  continual  turnover,  and  attempts  as 
best  it  can  to  mitigate  the  negative  effects.  Most 
important  is  the  institutionalization  of  continual,  cyclic 
training  as  part  of  organizational  and  individual 
expectations.  This  is  designed  to  bring  new  people  up  to 
speed  with  the  current  phase  of  the  cycle,  thus  stabilizing 
the  environment  just  before  and  during  deployment  at  the 
cost  of  pushing  the  turbulence  down  into  individual  units. 
Although  the  deployment  cycle  clearly  distinguishes  periods 
of  "training"  from  those  of  "operations",  it  is  a  measure  of 
competence  and  emphasis,  not  of  procedural  substance,  that 
applies  primarily  to  the  ship  as  a  unit,  not  its  men  as 
individuals. 

The  result  is  a  relatively  open  system,  which  exploits 
the  process  of  training  and  re-training  as  a  means  for 
socialization  and  acculturation.  At  any  given  moment,  all 
but  the  most  junior  of  the  officers  and  crew  are  acting  as 
teacher  as  well  as  trainee.  A  typical  Lt.  Commander,  for 
instance,  aimuitanoously  tries  to  master  his  present  job, 
train  his  juniors,  and  learn  about  the  next  job  he  is  likely 
to  hold.  If  he  has  just  coma  aboard,  he  is  also  engaged  in 
trying  to  master  or  transfer  all  the  cumulated  knowledge 
about  the  specifics  of  task,  ship,  and  personnel  in  a  time 
rarely  exceeding  a  few  weeks. In  addition  to  these 
informal  officer-officer  and  officer-crew  interactions, 
officers  and  crew  alike  are  also  likely  to  be  engaged  in  one 
or  more  courses  of  formal  study  to  master  new  skills  in  the 
Interest  of  career  advancement  or  rating. 

As  a  result,  the  ship  appears  to  us  as  one  gigantic 
school,  not  in  the  sense  of  rote  learning,  but  in  the 
positive  sense  of  a  genuine  search  for  acquisition  and 
improvement  of  skills.  One  of  the  great  enemies  of  high 
reliability  is  the  usual  "civilian"  combination  of 
stability,  routinization,  and  lack  of  challenge  and  variety, 
which  predispose  an  organization  to  relax  vigilance  and  sink 
into  a  dangerous  complacency  that  can  lead  to  carelessness 
and  error. The  shipboard  environment  on  a  carrier  is 
never  that  stable.  Traditional  ways  of  doing  things  are 
both  accepted  and  constantly  challenged.  Young  officers 
rotate  in  with  new  ideas  and  approaches;  old  chiefs  remain 
aboard  to  argue  for  tradition  and  experience.  The  resulting 
dynamic  can  be  the  source  of  additional  confusion  and 
uncertainty  at  times,  but  at  its  best  leads  to  a  constant 
scrutiny  and  re-scrutiny  of  every  detail,  even  for  SOPs. 


In  general,  the  Navy  has  managed  to  turn  the  rapid 
turnover  to  advantage  through  a  number  of  mechanisms  that 
have  evolved  by  trial>and>error  for  the  purpose  of 
insulating  against  personnel  changes.  SOPs  and  procedures, 
for  example,  are  often  unusually  robus'*',  which  in  turn 
contributes  another  increment  to  relial  ility.  The  continual 
movement  of  people  rapidly  diffuses  or'  anlzational  and 
technical  innovation  as  well  as  "lessons  learned",  often  in 
the  form  of  "sea-stories",  throughout  the  organization. 
Technical  innovation  is  eagerly  sought  where  it  will  clearly 
increase  both  reliability  and  effectiveness,  yet  resisted 
when  suggested  purely  for  its  own  sake.  Operators  reading 
sophisticated  radar  systems  log  data  with  grease  pencils; 
indicators  for  the  cables  to  arrest  multi-million  dollar 
aircraft  are  set  and  checked  mechanically,  by  hand.  Things 
tend  to  be  done  in  proven  ways,  and  changed  only  when  some 
unit  has  demonstrated  and  documented  an  improvement  in  the 
field.  The  problem  for  the  analyst,  and  for  the  Navy,  is 
the  separation  of  functional  conservatism  from  pure 
tradition. 


Authority  Overlays 

We  also  have  noted  with  great  amazement  the 
adaptability  and  flexibility  of  what  is,  after  all,  a 
military  organization  in  the  day-to-day  performance  of  its 
tasks.  On  paper,  the  ship  is  formally  organized  in  a  steep 
hierarchy  by  rank,  with  clear  chains  of  command  and  means  to 
enforce  authority  far  beyond  that  of  any  civilian 
organization.  We  supposed  it  to  be  run  by  the  book,  with  a 
constant  series  of  formal  orders,  salutes,  and  yes-sirs. 
Often  it  is.  But  flight  operations  are  not  conducted  that 
way. 

Flight  operations  and  planning  are  usually  conducted  as 
if  the  organization  were  relatively  "flat"  and  collegial. 
This  contributes  greatly  to  the  ability  to  seek  the  proper, 
immediate  balance  between  the  drive  for  safety  and 
reliability  and  that  for  combat  effectiveness.  Events  on 
the  flight  deck,  for  example,  can  happen  too  quickly  to 
allow  for  appeals  through  a  chain  of  command  to  a  formal 
authority.  Even  the  lowest  rating  on  the  deck  has  not  only 
the  authority,  but  the  obligation  to  suspend  flight 
operations  Immediatelyi ,  and  without  first  clearing  it  with 
superiors,  under  the  proper  circumstances.  Although  his 
judgement  may  later  be  reviewed  or  even  criticized,  he  will 
not  be  penalized  for  being  wrong,  and  Vili  often  be 
publicly  congratulated  if  he  is  right. 

Coordination  of  planning  for  the  next  day^o  air 
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oparations  raqulraa  a  aarlaa  of  involvad  tradeoffs  between 
mission  req[uirements  and  the  demands  of  training,  flight 
time,  maintenance,  ordnance,  and  aircraft  handling.  It  is 
largely  done  by  a  process  of  ongoing  and  continuing  argument 
and  negotiation  among  personnel  from  many  units,  in  person 
and  via  phone,  which  tend  to  be  resolved  by  direct  order 
only  when  the  rare  impasse  develops  that  requires  an  appeal 
to  higher  authority.  In  each  negotiation,  most  officers 
play  a  dual  role,  resisting  excessive  demands  from  others 
that  would  compromise  the  safety  or  future  performance  of 
their  units,  while  maximizing  demands  on  others  for 
operational  and  logistic  support. 

This  does  not  mean  that  formal  rank  and  hierarchy  are 
unimportant.  In  fact,  they  are  the  l\ibr leant  that  makes  the 
informal  processes  work.  Unlike  the  situation  in  most 
civilian  organizations,  relative  ranking  in  the  hierarchy  is 
largely  stable,  and  shaped  by  regular  expectations  and 
formal  rules  and  procedures.  Although  fitness  reports  and 
promotion  review  boards  are  not  free  of  abuses  or  paradoxes, 
the  shipboard  situation  tends  to  promote  cooperative 
behavior,  which  tends  to  minimize  the  negative  effects  of 
jealousy  and  direct  competition.^^  Although  officers  of  the 
same  rank  are  competitively  rated,  each  stands  to  benefit  if 
joint  output  is  maximized  and  suffer  if  the  unit  is  not 
performing  well.  Thus,  we  rarely  observe  such  strategies  as 
the  hoarding  of  information,  or  the  deliberate  undermining 
of  the  ability  of  others  to  perform  their  jobs,  that 
characterize  so  many  civilian  organizations,  particularly  in 
the  public  sector. 


Redundancy 

Operational  redundancy  ~  the  ability  to  provide  for 
the  execution  of  a  task  if  the  primary  unit  fails  or  falters 
—  is  a  necessity  for  hlgh-reliabillty  organizations 
managing  activities  sufficiently  dangerous  to  cause  serious 
consequences  in  the  case  of  operational  failures. In 
classic  organization  theory,  redundancy  is  provided  by  some 
combination  of  duplication  [two  units  performing  the  same 
function]  and  overlap [two  units  with  functional  areas  in 
common] .  Its  enemies  are  mechanistic  management  models  that 
seek  to  eliminate  these  valuable  modes  in  the  name  of 
"efficiency".*®  For  a  carrier  at  sea,  several  kinds  of 
redundancy  are  necessary  even  for  normal  peacetime 
operations,  each  of  which  creates  its  own  kinds  of  str-'ss, 

A  primary  form  is  technical  redundancy,  involving 
operations-critical  units  or  components  on  board  — 
computers,  radar  antennas,  etc.  In  any  fighting  ship,  as 
much  redundancy  is  built  is  as  in  practicable.  This  kind 
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of  redundancy  is  traditional,  and  well  understood.  Another 
form  is  supply  redundancy.  The  ship  must  carry  as  many 
aircraft  and  spares  as  possible  to  keep  its  power  projection 
and  defensive  capability  at  an  effective  level  in  the  face 
of  maintenance  requirements,  and  possible  operational  or 
combat  losses.  Were  deck  and  parts  loading  reduced,  many  of 
the  dangers  and  tensions  involved  in  scheduling  and  moving 
aircraft  would  be  considerably  lessened.  Here  is  a  clear 
case  of  a  tradeoff  between  operational  and  safety 
reliability  that  must  be  made  much  closer  to  the  edge  of  the 
envelope  than  would  be  the  case  than  for  other  kinds  of 
organizations.  Indeed,  for  a  combat  organization,  the 
tradeoff  point  is  generally  taken  as  a  measure  of  overall 
competence . ^9 

Most  Interesting  to  our  research  is  a  third  form, 
decision/manaaement  redundancy,  which  encompasses  a  number 
of  organizational  strategies  to  ensure  that  critical 
decisions  are  timely  and  correct.  This  has  two  primary 
aspects:  (a)  internal  cross-checks  on  decisions,  even  at  the 
micro  level;  and,  (b)  fail-safe  redundancy  in  case  one 
management  unit  should  fail  or  be  put  out  of  operation.  It 
is  in  this  area  that  the  rather  unique  Navy  way  of  doing 
things  is  the  most  interesting  theoretically  as  well  as 
practically. 

As  an  example  of  (a) ,  almost  everyone  involved  in 
bringing  the  aircraft  on  board  is  part  of  a  constant  loop  of 
conversation  and  verification,  taking  place  over  several 
different  channels  at  once.  At  first,  little  of  this 
chatter  seems  coherent,  let  alone  substantive,  to  the 
outside  observer.  With  experience,  one  discovers  that 
seasoned  personnel  do  not  "listen”  so  much  as  they  monitor 
for  deviations,  reacting  almost  instantaneously  to  anything 
that  does  not  fit  their  expectations  of  the  correct  routine. 
This  constant  flow  of  information  about  each  safety-critical 
activity,  monitored  by  many  different  listeners  on  several 
different  communications  nets,  is  designed  specifically  to 
assure  that  any  critical  element  that  is  out  of  place  will 
be  discovered  or  noticed  by  someone  before  it  causes 
problems . 

Setting  the  arresting  gear,  for  example,  requires  that 
each  inccaing  aircraft  be  identified  (for  speed  and  weight), 
and  each  of  four  Independent  arresting  gear  engines  set 
correctly.^®  At  any  given  time,  as  many  as  a  dozen  people 
in  different  parts  of  the  ship  may  be  monitoring  the  net, 
and  the  settings  are  repeated  in  two  different  places  (Pri- 
Fly  and  LSC) .  During  a  trip  aboard  Enterprise  in  April  of 
1987,  she  took  her  250,000th  arrested  landing,  representing 
about  1,000,000  individual  settings. Because  of  the 
redundancies  built  in,  and  the  cross-familiarity  of 
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personnel  with  each  other's  jobs,  there  had  not  been  a 
single  recorded  instance  of  a  reportable  error  in  setting 
that  resulted  in  the  loss  of  an  aircraft. 


Fail-safe  redundancy,  (b) ,  is  achieved  in  a  number  of 
ways.  Duplication  and  overlap,  the  most  familiar  modes  of 
error-detection,  are  used  to  some  extent  —  for  example,  in 
checking  mission  weapons  loading.  Nevertheless,  there  are 
limits  to  how  they  can  be  provided.  Space  and  billets  are 
tight  at  sea,  even  on  a  nuclear-powered  carrier,  and,  unlike 
land-based  organizations,  the  sea-going  Navy  cannot  simply 
add  extra  departments  and  ratings.  Shipboard  constraints  and 
demands  require  a  considerable  amount  of  redundancy  at 
relatively  small  cost  in  personnel.  In  addition  to  the 
classic  "enlightened  waste"  approach  of  tolerance  for 
considerable  duplication  and  overlap,  other,  more  efficient 
strategies  that  use  existing  units  with  other  primary  tasks 
as  back-ups  are  required,  such  as  "stressing  the  survivor" 
and  mobilizing  organizational  "reserves" . 

Stressing  the  survivor  strategies  require  tnat  each  of 
the  units  normally  operate  below  capacity,  so  that  if  one 
fails  or  is  unavailable,  its  tasks  can  be  shifted  to  others 
without  severely  overloading  them.  Redundancy  on  the  bridge 
is  a  good  example. Mobilizing  reserves  entails  the 
creation  of  a  "shadow"  unit  able  to  pick  up  the  task  if 
necessary.  It  is  relatively  efficient  in  terms  of  both 
space  and  personnel,  but  places  higher  demands  on  the 
training  and  capability  of  individuals.  What  the  Navy 
effects  through  the  combination  of  generalist  officers,  high 
job  mobility,  constant  negotiation,  and  perpetual  training, 
is  a  mix  that  leans  heavily  on  reserve  mobilization  with 
some  elements  of  survivor  stressing.  Most  of  the  officers, 
and  a  fair  proportion  of  senior  enlisted  men,  are  familiar 
with  several  tasks  other  than  the  ones  they  normally 
perform,  and  could  do  them  in  an  emergency. 

The  Combat  Decision  Center  (CDC,  or  just  "Combat"),  for 
example,  is  the  center  for  fighting  the  ship.^^  Crucial 
decisions  are  thereby  placed  nominally  in  the  hands  of 
relatively  junior  officers  in  a  single,  comparatively 
vulnerable  location.  In  this  case  we  have  noted  several  of 
the  mechanisms  described  above.  There  is  a  considerable 
amount  of  senior  oversight,  even  in  calm  periods.  A  number 
of  people  are  "just  watching",  keeping  track  of  each  other's 
jobs  or  monitoring  the  situation  from  other  locations. 

There  is  no  one  place  on  the  ship  that  duplicates  the 
organizational  function  of  combat,  yet  each  of  the  tasks  has 
a  back-up  somewhere  —  some  on  the  carrier,  some  distributed 
among  other  elements  of  the  Battle  Group. 

In  an  "ordinary"  organization,  these  parameters  would 
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likely  be  characterized  In  negative  terns.  Back-up  systems 
differ  in  pattern  and  structure  from  primary  ones.  Those 
with  task  responsibility  are  constantly  under  the  critical 
eye  of  others.  Authority  and  responsibilities  are 
distributed  in  different  patterns,  and  may  shift  in 
contingencies.  In  naval  circxinstances  where  reliability  is 
paramount,  these  are  seen  as  positive  and  cooperative,  for 
it  is  the  task  that  is  of  primary  importance. 

Thus,  those  elements  of  Navy  "culture"  that  have  the 
greatest  potential  for  creating  confusion  and  uncertainty 
turn  out  to  be  major  contributors  to  organizational 
reliability  and  robustness  under  strain.  We  believe  this  to 
be  an  example  of  adaptive  organizational  evolution  to 
clrcximstance,  for  it  responds  very  well  to  the  fv-ctional 
necessities  of  modern  operations.  In  the  days  of  great, 
compact  flotillas,  loss  of  navigational  or  deck  or  gun 
capability  by  one  ship  could  be  compensated  for  by  shifting 
or  sharing  with  another.  There  is  only  one  carrier  in  a 
Battle  Group,  and  only  a  handful  of  other  ships,  spread  over 
many  hundreds  of  square  miles.  Each,  and  most  particularly 
the  carrier,  must  internalize  its  own  processes  and 
modalities  for  redundancy. 
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SoM  Prelialnaxy  Conclusions 

Evan  though  our  research  is  far  from  complete, 
particularly  with  regard  to  comparisons  with  other 
organizations,  several  interesting  observations  and  lessons 
have  already  been  recorded. 

First,  the  remarkable  degree  of  personal  and 
organizational  flexibility  we  have  observed  is  essential  for 
performing  operational  tasks  that  continue  to  increase  in 
complexity  as  technology  advances.  "Ordinary"  organization 
theory  would  characterize  aircraft  carrier  operations  as 
confusing  and  Inefficient,  especially  for  an  organization 
with  a  strong  and  steep  formal  management  hierarchy  ( 1 . e . , 
any  "quasi-military"  organization) .  However,  the  resulting 
redundancy  and  flexibility  are  in  fact  remarkably  efficient 
in  terms  of  making  the  best  use  of  space-limited  personnel. 

Second,  an  effective  fighting  carrier  is  not  a  passive 
weapon  that  can  be  kept  on  a  shelf  until  it  is  needed.  She 
is  a  living  unit,  possessed  of  dynamic  processes  of  self¬ 
replication  and  self-reconstruction  that  can  only  be 
nurtured  by  retaining  experienced  personnel,  particularly 
among  the  chiefs,  and  by  giving  her  sufficient  operational 
time  at  sea.  This  implies  a  certain  minimum  budgetary  cost 
for  maintaining  a  first-line  carrier  force  at  the  levels  of 
operational  capability  and  safety  demanded  of  the  U.S.  Navy. 

The  potential  risk  of  attempting  to  operate  at  present 
levels  under  increasing  budgetary  constraints  arises  because 
the  Navy  is  a  "can-do"  organization,  visibly  reluctant  to 
say  "we're  not  ready"  until  the  situation  is  far  into  the 
red  zone.^*^  In  time  of  war,  the  tradeoff  point  between 
safety  and  effectiveness  moves,  and  certain  risks  must  be 
taken  to  get  units  deployed  where  and  when  they  are  needed. 
In  peacetime,  the  potential  costs  of  deploying  units  that 
are  less  than  fully  trained  are  not  so  easily  tolerated.  If 
reductions  in  at-sea  and  flying  time  are  to  be  taken  out  of 
work-ups  to  preserve  operational  time  on  deployment, 
training  and  evaluation  procedures  will  have  to  be  adapted 
to  reduce  stress  —  perhaps  by  overlapping  final  readiness 
evaluations  into  the  beginning  of  the  deployment  period. 

Third,  as  long-term  students  of  organizations,  we  are 
astounded  at  how  little  of  the  existing  literature  is 
applicable  to  the  study  of  ships  at  sea.  Consider,  for 
example,  the  way  in  which  the  several  units  that  make  up  a 
Battle  Group  (carrier,  air  wing,  supply  ships,  escorts)  are 
in  a  continual  process  of  formation  and  re-formation. 

Imagine  any  other  organization  performing  effectively  when 
it  is  periodically  separated  from  and  then  rejoins  the  unit 
that  performs  its  central  technical  function.^®  More 
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importantly,  most  of  the  existing  literature  was  developed 
for  failure-tolerant,  civilian,  organizations  with  definite 
and  measurable  outputs.  The  complementary  body  on  public 
organizations  assumes  not  only  a  tolerance  for  failure,  but 
at  best  an  ambiguous  definition  of  what  measures  failure 
(or,  for  that  matter,  of  success) . 

Fourth,  we  have  been  encouraged  to  reflect  on  the  new 
large  Soviet  nuclear  carrier  now  being  fitted  out  in  the 
Black  Sea.^^  The  Soviet  Navy  is  completely  without 
experience  or  tradition  in  large  carrier  operations.  Their 
internal  structure  is  more  rigid  and  more  formal  than  ours, 
and  with  far  less  on-the-job  training,  especially  for 
enlisted  personnel. It  will  be  very  interesting  to  watch 
their  work-up  time,  deck  loading,  and  casualty  rates.  Of 
course,  it  is  not  clear  that  they  will  be  trying  to  emulate 
U.S.  carrier  operations  rather  than  the  rather  different 
style  and  objectives  of  the  British  or  French. In  either 
case,  we  estimate  a  minimum  of  several  work-ups  (each  taking 
perhaps  2-3  years)  before  they  begin  to  approach  the  deck 
loads  and  sortie  rates  of  comparable  Western  carriers,  and, 
unless  they  are  remarkably  lucky,  the  loss  of  not  a  few 
lives  in  the  learning  process. 

1.  See,  for  example,  Charles  Perrow,  Normal  Accidents  (New 
York:  Basic  Books,  1984). 

2.  Examples  that  have  attracted  recent  attention  include 
Bhopal,  Seveso,  Three  Mile  Island,  and  Chernobyl.  All  four 
meet  Peirow's  criteria  for  coupling,  response  time,  and 
complexity.  The  essence  of  a  "normal”  accident  is  that  the 
potentiality  inheres  in  the  design  of  the  system,  and, 
despite  attempts  to  fix  "blame",  is  not  primarily  the  result 
of  individual  misbehavior,  malfeasance,  or  negligence. 

3.  By  comparison,  civil  air  traffic  controllers 
deliberately  stay  far  away  from  the  edge.  Such  fixed  rules 
as  maintaining  five  mile  intervals  are  designed  to  err 
broadly  in  the  direction  of  safety.  Moreover,  the  turnover 
rate  for  controllers  is  relatively  low  (barring 
extraordinary  events  such  as  the  recent  strike) ,  and  even 
equipment  changes  are  few  and  far  between. 

4.  From  this  point  we  refer  to  carrier  personnel  as  "men", 
since  as  yet  the  Navy  does  not  allow  women  to  serve  aboard 
combat  vessels. 

5.  We  have  followed  both  the  U.S.S.  Carl  Vinson  (CVN-70) 
and  the  U.S.S.  Enterprise  (CVN-65) ,  under  a  total  of  four 
different  Captains,  through  their  training  and  work-up  from 
Alameda  and  San  Diego  and  across  the  Pacific  into  the  South 
China  Sea.  In  addition,  one  of  us  (Roberts)  has  been  able 
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to  observe  the  initial  sea  trials  of  the  U.S.S.  Theodore 
Roosevelt  (CVN-71) . 


6.  In  formal  organization  terms,  we  refer  to  this  as 
"decomposablllty" .  The  basic  notion  was  Introduced  by 
Herbert  A.  Simon  in  "The  Architecture  of  Complexity", 
Proceedings  of  the  American  Philosophical  Society.  106 
(December  1962),  467-482;  (reprinted  in  Herbert  A.  Simon, 

The  Sciences  of  the  Artificial  (Cambridge  MA;  The  MIT  Press, 
4981) . 

7.  During  our  interviews,  one  senior  officer  on  Flag  staff 
suggested  that  the  several  different  functional  and 
hierarchical  modes  of  organization  might  be  viewed  as  a  set 
of  "overlays"  that  are  superimposed  upon  the  formal 
organization  at  different  times  depending  upon  the  task  or 
circumstance  at  hand.  Many  of  the  officers  must  shift  roles 
many  times  during  the  course  of  a  single  active  day  of 
flight  operations. 

8.  The  few  examples  that  come  to  mind  are  large 
construction  projects,  e.g.,  nuclear  power  plants,  the 
Alaskan  pipeline,  etc.  However,  these  usually  have 
considerable  oversight  from  a  separate  firm  whose  sole  task 
is  to  coordinate  and  schedule  the  work  properly. 

9.  This  point  was  brought  home  sharply  by  the  effort  to 
bring  up  the  20G  computer  system  on  the  USS  Carl  Vinson, 
which  would  have  required  that  almost  complete  knowledge 
about  all  details  of  ship  operations  be  known  and  entered 
if  the  system  were  to  function  as  originally  intended.  In 
retrospect,  this  can  be  seen  as  a  near-impossible 
requirement  without  the  mounting  of  a  considerable  special 
effort  to  collect  and  organize  the  data. 

10.  Furthermore,  a  strong  Captain  is  capable  of  altering 
both  the  character  of  a  ship  and  the  way  it  operates,  if  he 
so  chooses. 

11.  Given  the  size  of  modern  jet  aircraft  and  the  number 
carried  at  full  load,  the  matter  of  spotting  is  far  from 
trivial.  Inefficient  spotting  can  greatly  reduce  the 
ability  to  move  aircraft  about  quickly.  Incorrect  spotting 
can  lead  to  serious  interference  with  operations,  or  even  to 
a  "locked"  deck,  in  which  it  becomes  impossible  to  move 
aircraft  at  all.  In  a  trial  using  the  deck  model  in  Flight 
Deck  Control,  one  of  us  managed  to  lock  the  deck  so 
thoroughly  that  an  aircraft  would  have  had  to  be  pushed  over 
the  side  to  free  it. 


12.  Some  non- functional  variations  are  being  reduced.  For 
example,  all  LSO  platforms  will  soon  be  located  at  the  same 
level  and  position  relative  to  the  arresting  gear  wires. 
However,  it  is  nearly  impossible  to  upgrade  all  of  the 
ships  at  once  when  new  equipment  in  introduced,  so  each  is 
at  a  different  stage  of  modification  and  upgrade  at  any 
given  point  in  time. 

13.  To  some  extent  this  situation  is  improving.  Landing 
System  Officers  (LSO) ,  for  example,  now  have  a  simulator  to 
work  with.  Although  this  is  no  substitute  for  experience 
when  "eyeball"  judgement  is  concerned,  it  helps. 

14.  As  one  Senior  Chief  remarked  to  us:  "You  have  to  know 
it,  but  it  rarely  helps  when  you  really  need  it." 

15.  Roger  Evered,  "The  Language  of  Organizations:  The  Case 
of  the  Navy",  in  Louis  R.  Pondy,  Peter  J.  Frost,  Gareth 
Morgan ,  and  Thomas  c .  Dandr idge ,  eds . ,  Organizational 
Symbol lam  (Greenwich  CT:  JAI  Press,  1983),  125-144. 

16.  A  very  few  stay  on  one  ship  for  many  years,  but  such 
"plank  owners"  are  rare  in  the  modem  Navy. 

17.  For  example,  the  first  crew  was  unable  to  spot  the  deck 
effectively;  Flight  Deck  Control  was  laid  out  with  the  deck 
model  at  right  angles  to  the  deck  (interfering  with  spatial 
visualization)  and  obstructing  the  Aircraft  Handling 
Officer's  direct  view  of  the  deck  out  of  his  only  window. 

18.  The  recent  grounding  of  USS  Enterprise  on  Bishop  Rock 
off  San  Diego  may  be  at  least  partially  due  to  her  being  in 
a  difficult  exercise  combining  elements  of  what  were  usually 
two  exercises.  See  Karlene  H.  Roberts,  "Bishop  Rock  Dead 
Ahead:  Thu  Grounding  of  U.S.S.  Enterprise",  submitted  to 
Naval  Institute  Proceedings.  The  effect  on  ship's  morale 
was  very  visible. 

19.  Lewis  Sorley,  "Prevailing  Criteria:  A  Critique",  in  Sam 
C.  Sarkesian,  ed.,  combat  Effectiveness  (Beverly  Hills:  Sage 
Publications,  1980),  57-93. 

20.  L.R.  Glguet,  "Coordinating  Army  Personnel  Agencies 
Using  Living  Systems  Theory:  An  Example,"  U.S.  Army  TRADOC, 
1979,  as  quoted  by  Sorley  at  p.  76-77. 

21.  The  term  "proficiency"  is  used  in  the  special  sense  of 
Hubert  L.  Dreyfus  and  Stuart  E.  Dreyfus,  Mind  Over  Machine 
(New  York:  Free  Press,  1986) ,  who  classify  five  steps  of 
skill  acquisition:  novice;  advanced  beginner;  competence; 
proficiency;  expertise.  For  most  officers  mastery  of  a 
specific  assignment  means  at  roost  the  acquisition  of 
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proficiency  —  the  ability  to  identify  situations  and  act 
upon  them  without  having  to  systematically  think  through  the 
procedural  steps  involved.  The  most  advanced  stage, 
expertise.  Involves  moving  past  "problem-solving"  to 
"intuition"  in  decision-making.  Examples  of  relevance  here 
include  the  flying  skills  of  experienced  pilots  and  the 
specific  expertise  of  senior  chiefs  —  in  each  case 
representing  many  years  of  continuous  practice  of  a  small 
range  of  specific  skills. 

22.  We  have  observed  several  mechanisms  used  by  the  Navy  to 
prevent  such  loss,  including  incentives  for  reporting 
successful  innovation  and  formal  procedures  for  their 
dissemination.  The  most  general  mechanism,  however,  is  the 
informal  dissemination  of  information  by  the  movement  of 
personnel,  and  through  those  responsible  for  refresher  and 
other  forms  of  at-sea  training.  A  most  remarkable 
combination  of  trainers  and  active  personnel  is  the 
recently  formed  association  of  Air  Bos'n^s,  which  holds 
annual  meetings  at  which  information  is  exchanged  and  formal 
papers  are  presented. 

23.  Officers  near  the  end  of  their  tours,  with  new 
assignments  in  hand,  are  often  also  trying  to  learn  as  much 
as  they  can  about  their  future  tasks  and  responsibilities. 

24.  K.  Weick,  "The  Role  of  Interpretation  in  High 
Reliability  Systems",  California  Management  Review.  39, 

1987,  112-127. 

25.  Roberts  (op.cit.)  observes  that  similar  rules  would 
operate  to  similar  advantage  on  the  Navigation  Bridge,  which 
of  necessity  operates  under  more  formal  and  traditional  rules. 

26.  Even  when  fitness  report  ratings  are  based  solely  on 
merit,  they  are  necessarily  subjective  to  some  degree.  It 
is  inherently  difficult  to  compare  ratings  taken  on 
different  ships,  in  different  peer  groups,  by  different 
superiors,  even  in  the  best  of  circumstance.  But  the 
general  opinion  among  those  we  have  interviewed  is  that 
direct  abuses  of  the  system  are  relatively  rare.  As  with 
all  hierarchical  organizations,  politics  will  begin  to  enter 
as  one  moves  to  higher  rank,  but  is  thought  to  be  a  minor 
factor  below  the  level  of  Captain. 

27.  We  note  that  the  kinds  of  redundancy  required  to  assure 
continued  effectiveness  in  combat  —  c.g.,  in  situations 
where  physical  damage  to  ship  or  command  chains  is 
anticipated  —  are  qualitatively  different  from  redundancy 
directed  primarily  to  assuring  the  performance  of  safety- 
critical  tasks.  Elements  of  the  former,  however,  are  often 
major  contributors  to  the  latter. 
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28.  Martin  Landau,  "Redundancy,  Rationality  and  the  Problem 
of  Duplication  and  Overlap,"  Public  Administration  Review. 

23  (Nov/Dec  1973),  316-351. 

29.  In  this  context,  we  note  that  the  tempo  and  character 
of  U.S.  carrier  operations  are  so  qualitatively  different 
from  those  of  other  navies  —  including  the  French,  British, 
and  prospective  Russian  —  that  the  envelope  itself  can  only 
be  measured  by  our  own  expectations  and  capabilities. 

30.  The  engines  are  in  different  compartments,  and  set  by 
hand  by  separate  operating  teeuns,  so  that  collective 
failures  in  setting  can  only  occur  at  the  command  level, 
i.e.,  in  the  Tower,  where  a  number  of  other  independent 
measures  for  cross-checking  and  redundancy  are  in  place. 

31.  During  heavy  flight  operations,  there  may  be  anywhere 
from  600  to  1000  settings  of  the  engines  during  a  single 
day.  A  typical  deployment  will  have  8,000  to  10,000 
arrested  landings  ("traps"),  involving  30,000  to  40,000 
settings  over  a  six  to  eight  month  period. 

32.  Although  the  probabilities  are  low,  the  possibility 
does  exist.  A  minor  error  may  simply  result  in  too  much 
runout,  cable  damage,  or  some  damage  to  the  aircraft.  But 
an  engine  set  for  too  heavy  a  weight  can  pull  a  tail  hook 
out,  leading  to  aircraft  loss;  setting  for  too  low  an 
aircraft  weight  can  result  in  its  "trickling"  over  the  end 
of  the  angle  deck  and  into  the  sea.  Experienced  Air  Bosons 
and  Chiefs  estimate  that  perhaps  six  or  seven  such  serious 
errors  have  occurred  throughout  the  entire  U.S.  fleet  over 
the  past  twenty  years.  Our  estimate  for  the  rate  of 
uncorrected  wrong  settings  with  serious  consequences  is 
therefore  about  one  in  a  million  —  roughly  comparable  to 
the  probability  of  a  mid-air  collision  in  a  domestic 
commercial  airline  flight.  Setting  errors  that  are 
corrected  are  "non-reportable"  incidents,  and  therefore  not 
documented.  We  also  note  that  on  the  USS  Carl  Vinson,  a 
much  newer  ship  with  a  still  unbroken  memory,  no  reportable 
incident  of  any  kind  could  be  recalled  in  the  first  70,000 
traps  since  its  commissioning. 


33.  Allan  W.  Lerner,  "There  Is  More  Than  One  Way  To  Be 
Redundant",  Administration  &  Society.  18,  No.  3  (November 
1986),  334-359. 

34.  This  was  brought  home  to  us  during  a  General  Quarters 
drill,  in  which  the  bridge  took  simulated  casualties. 


35.  During  tho  period  of  observation,  CDC  was  also  the 
center  for  fighting  the  Battle  Group,  a  task  that  will 
increasingly  be  supervised  by  the  new  Tactical  Hag  Command 
Centers  (TFCC)  as  they  are  Installed.  Depending  upon  the 
physical  arrangement  of  the  ship,  the  CDC  area  contains  the 
Combat  Information  Center  (CIC) ,  anti-air  warfare  control 
consoles,  and  perhaps  air  operations  and  ship  air  traffic 
control  (CATCC) ;  other  warfare  modules,  such  as  those  for 
anti-submarine  or  anti-surface  warfare,  may  also  be  included 
or  in  physically  adjacent  spaces. 

36.  For  example,  control  of  fighter  aircraft  can  be  done 
from  the  carrier,  from  an  E-2,  cr  from  one  of  several  other 
ships  in  the  group. 

37.  Evered,  op.  cit.,  lists  qualities  of  "responsiveness  to 
authority",  "being  ready",  "can  do",  and  "not  fazed  by 
sudden  contingencies"  as  among  the  more  'obvious'  character 
traits  of  Naval  officer  culture.  These  are  transmitted  by 
training  programs,  ceremonies,  and  historical  models.  The 
latter  is  particularly  important  for  the  'can  do'  aspect  of 
culture. 

38.  Not  only  are  the  ship  and  its  air  wing  parted,  but  the 
Wing  itself  is  split  into  component  squadrons,  which  train 
under  different  functional  commands. 

39.  No  definite  name  for  this  1000+',  angle-deck,  65-70,000 
ton  nuclear-powered  carrier  has  been  ascertained  at  this  time. 

40.  Bruce  W.  Watson  and  Susan  M.  Watson,  The  Soviet  Navv; 
Stcsnqthg  -and^labilitiss  (Boulder:  Westview,  1986)  . 

41.  Although  it  is  currently  believed  that  arresting  gear 
and  catapults  will  be  fitted,  and  the  deck  mock-up  at  Saki 
airfield  in  the  Crimea  is  so  equipped,  ski-ramps  for  a  total 
loading  of  60-70  STOL  aircraft  appear  more  likely  in  the 
short  term,  with  possible  future  retrofit  of  catapults  into 
pre-existing  deck  slots  at  some  future  date.  See,  for 
example.  Normal  Polmar,  Guide  to  the  Soviet  Navv.  4th 
Edition  (Annapolis:  Naval  Institute  Press,  1986),  1G4-165. 

42.  As  a  group,  we  doubt  they  will  be  able  to  approach  the 
operating  conditions  and  efficiency  of  U.S.  carriers  in  this 
century,  if  at  all,  even  if  they  master  the  associated  naval 
and  aircraft  technologies. 
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The  project  began,  summer, 1984 ,  within  a  small  group  of 
Berkeley  faculty  and  Note  1]  who  were  meeting  regularly 
to  discuss  an  organizational  problem  of  increasing  salience 
-  the  performance  of  a  growing  class  of  organizations  in 
both  the  public  and  private  sectors  charged  with  tasks  for 
which  the  societal  and  organizational  costs  of  "errors"  or 
"failures"  are  extremely  high.  [2]  Few  organizations 
perform  such  tasks  well,  yet  our  society  increasingly 
demands  that  significant  errors  be  avoided  in  organizations 
performing  a  host  of  critical  tasks,  e.g.,  toxic  waste 
disposal  or  nuclear  power  plant  operation. [^] 

A  series  of  workshops  brought  together  senior  operating 
officials  from  three  "high  reliability"  organizations 
located  nearby:  the  FAA's  Oakland  Enroute  Air  Traffic 
Control  Center,  PG&E's  Electric  Operations  Division,  the 
senior  officers  of  the  nuclear  powered  aircraft  carrier, 
U.S.S.  Carl  Vinson.  A  strikingly  similar  set  of  problems  - 
<.nd  solutions  -  emerged  from  these  discussions.  None  of 
these  organizations  had  been  studied  systematically.  Each 
was  quite  interested  in  further  study  and  opened  itself  to 
us.  Fortuitously,  we  had  had  substantial  experience  with 
each  one  in  earlier  and  somewhat  unrelated  projects.  We 
eagerly  took  up  the  opportunity  to  study  a  small  group  of 
organizations  whose  performance  not  only  meets,  but  exceeds 
criteria  and  expectations  based  on  other  experiences .[ 3 ] 

Each  of  these  organizations  perform  very  complex  and 
demanding  tasks  under  considerable  time  pressure,  and  do  so 
with  a  near-zero  error  rate  and  an  almost  total  absence  of 


^  Current  Berkeley  Faculty  Group:  Geoffrey  Gosling, 

Transportation  Engineering  -  Air  Traffic  Control,  Computer 
Applications;  Todd  R.  La  Porte,  Political  Science 
Organization  Processes,  Response  to  Complex  Technologies; 
Karlene  H.  Roberts,  Business  Administration  Organizational 
Behavior,  Decision  and  Group  Processes;  Gene  I.  Rochlin, 
Energy  and  Resources  -  Technology  and  Organizations,  Energy 
and  Regulation.  Corresponding  Faculty:  Karl  Weick,  School 
of  Business  Administration,  University  of  Texas,  Austin, 
Social  Psychology  and  Organizational  Behavior;  Denise  M. 
Rousseau,  Business  Administration,  Northwestern  University  - 
Organizational  Behavior  and  Methodology;  W.  Richard  Scott, 
Stanford  University  -  Organization  Theory;  and  Charles 
Perrow,  Yale  University  -  Organization  Theory. 


2  Regrettably,  NASA''s  space  shuttle  launch  management 
must  be  placed  in  the  category  of  organizations  that 
"failed"  under  the  joint  stress  of  demands  for  very  high 
reliability  and  operational  continuity. 
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catastrophic  fallurs.  Based  on  our  work  thus  far,  it  Is 
evident  that  they  have  a  number  of  similar  characteristics: 

— Each  organization  has  a  strong,  reasonably  concrete  sense 
of  its  primary  missions,  operational  goals  and  the  technical 
means  necessary  to  accomplish  them. 

All  operate  quite  powerful,  knowledge  Intensive 
technologies  with  very  few  significant  operational  failures. 
These  technical  systems  are  well  known;  their  mechanisms  and 
processes  can  be  nearly  completely  specified. 

--Their  production  units,  e.g.,  power  station,  ATC  center, 
or  naval  vessel,  are  quite  complex  and  linked  together  into 
large  operating  networks,  e.g.,  power  grid,  national  system, 
or  task  force,  that  strongly  effects  levels  of  internal 
operating  strains  and  the  capacity  to  adjust  to  surprise. 

—  T'ley  manage  activities  for  which  external  or  internal 
i  >iisequences  of  failure  are  perceived  to  be  great.  The  rare 
operational  failure  gravely  threatens  the  organization's 
capacity  to  operate,  to  deliver  crucial  services,  and/or 
threatens  the  lives  of  its  members  or  those  of  the  community 
at  large.  As  a  result,  *'error8'*  such  as  near-misses  between 
aircraft,  partial  blackouts,  or  damaged  or  diverted  military 
aircraft  are  almost  as  difficult  to  tolerate  as  actual 
system  failures,  e.g.,  mid-air  collisions,  extensive  system 
shut  downs,  or  loss  of  aircraft  or  lives. 

—There  is  a  high  degree  of  agreement  in  the  society 
regarding  the  events,  accidents  or  failures  to  be  avoided 
(and  within  the  organization  on  the  indications  of  the 
on-set  of  such  failures.) 

—  Each  organization  has  accepted  the  signal  Importance  of 
reliable,  safe  operations  as  a  major  goal  and  there  appears 
to  be  an  ethic  of  personal  responsibility  for  the  safe 
operation  of  the  whole.  There  is  an  operating  "culture" 
that  is  strongly  failure  averse.  Internal  dynamics  and 
structures  are  predominantly  influenced  by  the  requirement 
to  avoid  certain  types  of  events,  accidents  or  failures. 
However  formal  the  organization,  the  informal  operating 
structure  shares  responsibility  for  maintaining  safety  in  a 
largely  non-  hirerachical  way. 

—  Despite  the  diversity  of  their  tasks,  operators  in  each 
system  have  similar  working  environments,  share  similar 
responsibilities,  expectations,  objectives,  and  goals,  and 
show  similar  manifestations  of  the  stress  of  their  jobs. 

—  In  each  case,  it  is  the  judgment,  experience,  and  trained 
intuition  of  seasoned  operators  that  is  most  responsible  for 
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maintaining  aystams  raliability  and  safety.  The  historical 
learning  process  has  been  one  of  trial  and  error,  but  in  an 
unusual  sense.  Open  acknowledgement  of  and  acceptance  of 
responsibility  for  past  error  is  rewarded  in  the  interest  of 
prompting  future  improvement. 

—  Organizational  structures,  authority  relationships,  and 
decision-  making  dynamics  appear  to  have  evolved  in  common 
patterns:  there  is  clear  separation  of  operating  from  system 
maintenance,  substantial  delegation  of  operating  authority 
to  subordinate  units,  and  redundant  infoirmation  sources  to 
Inform  decision-making. 

—  Each  of  these  organizations  has  seen  its  workload 
increase  while  its  resources  base  has  been  in  relative 
decline  in  recant  years:  air  traffic  has  increased  in  a 
system  still  recovering  from  the  controller's  strike  of  a 
few  years  ago;  utility  grid  management  Is  becoming  much  more 
complex  as  large  nui^ers  of  relatively  small  Independent 
electricity  producers  come  on  line;  naval  aircraft  have 
become  faster,  heavier,  and  more  complex  and  deck  load 
density  has  increased. 

—  Due  to  increased  relative  demand,  an  additional  level  of 
sustained  stress  has  been  added  to  the  amount  of  stress 
operators  are  expected  to  absorb  In  highly  responsible 
time-urgent  jobs,  calling  for  maintaining  absolute 
performance  levels.  In  the  face  of  Increasing  magnitude  and 
complexity  of  the  tasks. 

—  Computers  and  other  technical  systems  are  used,  often 
extensively,  but  primarily  as  sources  of  information  and 
data  —  Inputs  to  human  judgment.  Recently,  In  the  face  of 
Increasing  demand,  each  organization  has  been  pressed  to 
turn  to  new  computer  technologies  in  the  hope  of  Increasing 
Its  operational  capacity  without  directly  altering 
organizational  size  or  structure. 

—  Finally,  the  organizations,  by  virtue  of  their  high 
reliability,  have  been  nearly  invisible  to  the  public.  The 
more  failure- free  their  operation,  the  less  opportunity  for 
"outsiders"  to  learn  about  them.  It  appears  likely  that 
policy  makers  and  Interested  consumer  groups  are 
systematically  under-informed  about  the  organizations' 
actual  requirements  and  dynamics. 

Two  Implications  of  this  pattern  of  conditions  follow: 
unexpected,  subtle  and  unpredictable  consequences  are  likely 
to  result  from  the  introduction  of  powerful  and  demanding 
new  technical  systems  Into  organizations  as  large  and 
complex  as  these;  and  criticisms  and  proposals  for  change 
are  likely  to  underestimate  or  misunderstand  their 
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cons«qu«nc0s  for  organizational  operations. 

The  research  group  has  undertaking  observations  in  each 
of  these  organizations  to  answer  questions  about  how  they 
manage  to  attain  such  high  levels  of  reliable  performance 
while  maintaining  the  capacity  for  sustained  peak 
performance,  and  how  they  redesign  themselves  in  the  face  of 
contingencies  not  considered  by  their  original  designers. 
It  is  already  apparent  that  existing  management  and 
organizational  theory  must  be  modified,  indeed  extended,  to 
address  design,  management,  training  and  related  Issues. 
When  these  modifications  are  made  and  tested,  they  can  be 
used  to  derive  policies  to  help  Insure  that,  as  an 
increasing  numbers  of  complex  systems  are  developed,  they 
are  not  accompanied  by  a  raise  the  likelihood  of 
catastrophic  error. 

Each  of  these  studies,  briefly  described  below,  has  a 
different  technical  focus  and  unqiue  set  of  operational  and 
instrumental  conditions.  Each  is  directed  to  a  specific  set 
of  Immediate  concerns  identified  by  the  particular 
organization.  Our  common  objective  is  to  gain  a  deeper 
understanding  of  the  conditions  and  costs  to  the 
organizations  and  their  personnel  of  those  activities  and 
stresses  associated  with  maintaining  such  high  levels  of 
reliable  performance.  This  is  enabling  us  to  identify  a 
larger  set  of  specific  operational  issues  and  alert  us  to 
the  problems  of  at  least  maintaining  or  increasing  the 
operational  reliability  of  a  variety  of  very  complex 
systems . 

Finally,  an  important  aspect  of  this  work  has  been  a 
series  of  workshops  involving  senior  operating  officers  from 
each  organization.  To  date  eight  day-long  meeting  have  been 
held,  first,  on  site  in  each  organization  to  brief  the  group 
on  the  reliability  aspects  of  its  operations,  then  to 
examine  cross-cutting  and  comparative  Issues,  e.g.,  the 
function  and  surprises  in  training  activities,  problems  of 
formal  and  Informal  control  system  management  during  the 
onset  of  operational  stress,  and  variations  of  working  group 
cultures  within  high  reliability  organizations.  Recent 
workshops  have  centered  on  provisional  findings  from  our 
work  thus  far. 

Below  is  a  brief  description  of  our  work  with  each 
organization.  (Modest  support  for  this  work  has  come  from  a 
number  of  sources  indicated  for  each  stud*'  area  along  with 
those  of  the  team  that  assume  initial  responsibility.  In 
June,  we  received  a  grant  from  the  National  Science 
Foundation  to  continue  this  work.) 

1.  U.S.  Air  Traffic  Control.  (La  Porte  and  Gosling) 
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[UCB,  Inst,  of  Transport.  Studies  ] 

Study  of  the  evolution  of  ATC  was  begun  In  1980, 
examining  the  technical,  organizational  and  Institutional 
conditions  which  had  resulted  In  a  stunning  level  of 
operational  reliability.  Intensive  examination  of  technical 
and  organizational  changes  were  conducted  through  reviews  of 
documents  and  extensive  Interviewing  at  FAA  headquarters  In 
Washington,  D.C.,  and  at  Washington  and  later  Oakland  Air 
Route  Traffic  Control  Centers.  The  PATCO  strike  so 
disrupted  the  FAA  that  the  study  was  "put  on  hold”  for 
nearly  two  years  after  the  strike,  and  was  resumed  when  the 
organization's  equilibrium  was  regained.  Subsequent  work  In 
Washington  and  at  Oakland  Center  has  been  done  to  explore  1) 
the  longer  lasting  effects  of  the  strike,  and  2)  the 
potential  for  surprise  and  personnel  difficulties  that  could 
accompany  the  Introduction  of  the  newest  technical  proposals 
for  automation  of  air  control  functions. 

In  fall  1985,  further  study  In  Washington  and  In 
several  ATC  centers  was  begun  (by  La  Porte)  to  further  the 
work  begun  In  1980.  Other  work  has  proceeded  Independently 
(by  Gosling)  on  aspects  of  the  use  of  "artificial 
Intelligence”  for  various  ATC  functions.  Both  Gosling  and 
La  Porte  have  familiarized  themselves  with  the  operation  of 
European  Air  Traffic  Control  during  visits  to  ERUOCONTROL 
facilities  near  Paris  and  Brussels,  by  La  Porte  In  June, 
1986,  and  both  La  Porte  and  Gosling  In  September  1987  with 
visits  to  EUROCONTROL  facilities  near  Paris,  Brussels,  and 
the  operational  center  at  Maastricht,  Netherlands.  Three 
week  were  spend  at  the  FAA  facilities  In  Washington,  D.C., 
and  Leesburg,  VA,  April  1988,  to  up-date  the  teams 
Information  on  changes  In  policies  and  operations  during  the 
past  three  years  anticipating  moderately  intensive  in-site 
observations  at  Oakland  Center,  this  summer. 

Arrangements  have  been  made  to  conduct  on-site 
observations  and  interviewing  at  ATC  enroute  and  terminal 
control  facilities,  especially  in  periods  of  operational 
stress. 


2.  The  Electric  Operations  Department,  Pacific  Gas  and 
Electric  Company.  (La  Porte,  Rochlin)  [UC  Energy 
Research  Group;  PG&E] 

Studies  began  in  1981-82  as  part  of  a  stu-^y  on  the 
effects  of  dispersed  energy  supply  on  organizational  change. 
To  our  surprise,  we  discovered  that  the  management  of  the 
electrical  power  distribution  grid  had  many  similarities  to 
what  we  had  found  in  the  FAA.  In  1984,  we  resumed 
systematic  contacts  with  PG&E,  with  several  briefings  on 
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their  operations  and  periodic  discussions  of  the  challenges 
they  face  in  the  next  decade. 

In  susuner  1985,  we  continued  charting  the  evolution  of 
the  grid  management  function  and  operating  organizational 
structures,  decision-  making  dynamics,  the  demands  of 
increased  conservation  and  load  management  efforts,  and  the 
changes  associated  with  new  automated  information  control 
technologies  may  have  within  PG6E  as  they  continue  to  be  the 
pivotal  actor  in  the  Western  States  power  grid.  This 
general  phase  included  the  beginning  of  systematic  study  of 
the  past  decade's  development  of  the  Electric  Operations 
Department  and  an  examination  of  routine  and  emergency 
switching  decision-making  and  performance. 

Two  more  detailed  studies  were  initiated  in  winter, 
1986:  the  first  examined  the  organizational  effects  of 
managing  the  growing  number  of  widely  dispersed, 
independently  owned  electric  power  producers.  The  second 
studied  the  political  dynamics  arising  from  a  series  of 
persistent  major  outages  in  a  large  Central  Valley 
community,  and  the  utility's  response  to  the  difficult 
technical  and  operational  problems  involved  is  nearly 
completed.  This  paper  will  be  submitted  for  publication 
soon.  Workshops  were  devoted  to  each  project. 

Arrangements  are  being  made;  1)  to  develop  an 
organizational  history  of  PG&E's  leadership  and  operational 
involvement  in  establishing  the  California  Power  Pool,  the 
association  of  utilities  increasing  tied  together  in  power 
transfers  that  greatly  improves  regional  performance,  and  2) 
to  conduct  on-site  observations  of  several  switching 
centers,  especially  in  periods  of  operational  stress. 

3.  Nuclear  Aircraft  Carriers.  (Roberts,  La  Porte, 
Rochlin)  (UCB,  Inst,  of  Govt.  Studies,  Sch.  of  Bus. 

Ad.;  Office  of  Naval  Research,  U.S.  Navy] 

Over  two  years  ago,  initial  acquaintance  with  these 
very  complex,  tightly-packed  organizations  was  began  at 
pier-side  locally  with  U.S.S.  Carl  Vinson  and  continued 
at-sea  during  an  Intensive  period  of  her  deployment.  After 
intensive  briefings  on  the  ship's  operation,  two  of  us 
boarded  her  for  17  days  underway  off  Japan,  December,  1984, 
to  observe  her  management  and  technical  teams.  During 
flight  operations  at-sea,  field  data  were  collected  from  our 
observations  and  the  results  of  interviews  with  her  senior 
officers,  about  how  various  of  her  department  are  managed, 
how  crucial  decisions  are  made,  and  how  her  departments  are 
interlinked  to  carry  out  the  overall  functions  of  a  modern 
aircraft  carrier.  These  data  and  subsequent  at-sea 
experience  provide  foundation  for  understandin<^  of  the 
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conditions  which  have  resulting  in  the  Carl  Vinson very 
good  record,  and  the  potential  changes  in  operations  that 
should  or  should  not  be  seriously  considered  (including  the 
mounting  of  additional  computerized  decision  making  aids.) 

During  Summer,  1985,  in  addition  to  continued  study  of 
Carl  Vinson,  we  extended  our  work  to  Include:  a)  a  parallel 
study  of  U.S.S.  Enterprise,  the  second  nuclear  carrier  in 
Carrier  Group  Three  (CARGRU  3);  and  b)  the  effects  of  a  new 
computer  based  information  system  designed  to  aid 
decision-making  in  the  command  of  CARGRU  3,  with  particular 
attention  to  the  effects  on  staff  planning  and  subsequent 
relationship  to  reliable  carrier  air  operations,  and  the 
CARGRU  coordination  of  the  battle  group  underway.  This 
presented  the  opportunity  for  a  comparison  of  two  carriers, 
in  the  same  command,  but  with  quite  different  histories  - 
the  Enterprise,  a  long  established  ship,  first  of  her  class 
and  the  much  newer  Vinson.  We  are  observing  the  process 
each  goes  through  during  her  readiness  "workup,"  i.e.,  the 
evolution  from  early  preparations  to  full  readiness  for 
deployment  in  the  Pacific.  There  is  also  the  opportunity  to 
examine  the  interaction  of  new  technologies  with  established 
operations  on  the  performance  of  the  ships 

Research  on  Carl  Vinson  has  been  conducted  periodically 
during  the  ship's  "work-up"  to  a  full  state  of  readiness 
after  undergoing  overhaul  and  repair  routinely  carried  out 
after  each  major  deployment.  The  team  boarded  the  ship  for 
five  at-sea  periods,  from  mid-winter  through  mid-Sept. , 1986. 
rata  collected  include  observations  of  the  ship's 
navigation,  air  and  combat  coordination  operations,  and 
survey  data  on  organizational  culture,  and  communication 
from  both  elements  of  the  ship's  Air,  Operations  and 
Engineering  Departments  and  five  squadrons  and  command  staff 
of  the  Air  Wing.  The  last  at-sea  period  was  at  a  time  of 
"practiced  readiness,"  just  before  starting  battle  patrol  in 
the  Indian  Ocean,  when  operations  are  intense  and  involve 
tightly  interdependent  decision-making  dynamics. 

A  similar  study  began  with  U.S.S.  Enterprise  in 
February,  1987,  after  she  completed  "overhaul  and  repair." 
The  final  field  segment  of  three  weeks  of  on-board 
observation  was  completed  in  Jan.  Survey  data  was  collected 
from  five  squadrons  and  several  ship's  departments.  The 
team  observed  operating  dynamics  during  four  separate  at-sea 
periods.  In  addition,  several  visits  have  been  made  to 
headquarters,  Navy  Air  Force  Pacific,  San  Diego,  to 
gathering  information  on  the  quantity  and  character  of  shore 
based  support  to  ship  board  high  reliability  activities. 
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MOTES 


1.  The  three  senor  researchers  have  the  following 
relevant  research  and  experience.  T.R.  La  Porte; 
research  and  advisory  experience  on  issues  of 
radioactive  waste  and  nuclear  power  plant 
operation;  studies  of  California  electric  power 
system,  and  the  national  and  European  air  traffic 
control  systems,  and  for  a  decade  was  sponsored  by 
the  U.S.  Marine  Corps  as  a  user  of  air  traffic 
control  and,  for  a  short  time,  aircraft  carrier 
services.  Karlene  Roberts:  research  on 
communication  and  organization  In  the  first  Maval 
Squadron  to  receive  the  F-14  aircraft;  advisory 
and  legal  experience  on  personnel  matter  in  complex 
organization  involving  hazards  to  employees.  Gene 
Rochlin:  research  on  radioactive  waste  management 
and  other  aspects  of  nuclear  technology  and  safety; 
nuclear,  fossil  fueled,  and  alternative  energy 
systems,  including  distributional  effects  and  grid 
management;  other  advanced  technological  systems 
including  military  technologies,  nuclear  weapons 
and  control  systems. 

2.  See,  for  example:  Todd  R.  La  Porte,  "The  Design  and 

Management  of  Nearly  Error-Free  Organizational 
Control  Systems,"  in  D.  Sills,  C.  Wolf,  and  V. 
Shelanski,  eds.  The  Accident  at  Three-Mile  Island: 
Human  Dimens.ions  (Boulder,  CO.:  Westview  Press, 
1982);  --,  "Managing  Nuclear  Wastes," 

Society/Transactions,  July/August,  1984;  "Nuclear 
Wastes:  Increasing  Scale  and  Sociopolitical 

Impacts,:  Science,  191  (7  July  1978),  22-29.  For  a 
good  description  of  the  problems  organizations  face 
with  low-probability,  high  consequence  events,  see. 
C.  Perrow,  Normal  Accidents,  (New  York:  Basic 
Books,  1984.) 

3.  A  striking  example  is  air  traffic  control,  where 
serious  errors  can  threaten  lives  or  completely 
disrupt  commercial  air  traffic,  see  T.R.  La  Porte, 
"The  Search  for  Nearly  Error-Free  Management; 
Lessons  from  Air  Traffic  Control  for  the  Future  of 
Nuclear  Energy,"  for  Colloquium  Series,  Woodrow 
Wilson  International  Center  for  Scholars, 
Smithsonian  Institution,  Nov.  1980. 
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2.  HIGH  RELIABILITY  ORGANIZATION  PROJECT  PAPERS 

1.  T.R.  La  Porte,  "High  Reliability  Organization  Project 
Summary,"  rev.  7,  May  1988 

The  latest  in  a  series  of  short  overview  summaries  of 
the  UC  Berkeley  Project. 

2.  T.R.  La  Porte,  "High  Reliability  Organizations;  The 
Research  Challenge."  March  1987 

The  conceptual  paper  that  outlines  the  theoretical 
problem,  the  conceptual  orientation  and  particular 
definitions  informing  the  High  Reliability  Organization 
Project,  including  the  requisites  of  high  reliability 
organizational  dynamics. 

Papers  Drawn  from  Carrier  and  Navy  Work. 

3.  K.H.  Roberts  and  R.  Boettger,  D.W.  Scott,  and  S.B. 

Sloane,  "USS  Carl  Vinson:  An  Evaluative  History." 

1985. 

The  early  development  of  USS  Carl  Vinson  is  discussed. 
Attention  is  focused  on  the  ship's  early  use  of  an 
artificial  intelligence  system  and  its  demise.  The 
environment  of  the  ship  is  described  along  with 
problems  that  developed  and  the  way  they  were  addressed 
is  discussed.  Finally,  differences  between  the  first 
and  second  commanding  officers  of  the  ship  are 
highlighted.  Used  by  US  Navy  for  development  of  new 
ships  and  ship's  emerging  from  Ship's  Life  Extension 
Program  (SLEP.) 

4.  J.L.  Eccles,  Interdependence  in  a  Highly  Complex 
Organization."  MBA  Thesis,  June  1986 

A  study  of  on-board  interactions  between  the  Carrier 
Air  Group  and  its  host  carrier,  including  the  various 
kinds  of  interdependence  that  characterize  the 
relationship  of  ship's  company  to  her  air  wing  aboard 
USS  Enterprise  are  the  focus  of  this  paper.  A  new  kind 
of  interdependence  (flexiole  reciprocal 
interdependence)  is  defined. 

5.  G.I.  Rochlin,  "Technology  Specification  and  Operator 
'Power'  in  Large  Organizations;  The  Special  Case  of 
Naval  Aircraft  Carrier  Flight  Operations'",  July  1986. 
This  paper  discusses  the  unusual  degree  of  authority 
over  technical  specification  that  is  possessed  by  the 
naval  carrier  community,  analyzing  the  degree  to  which 
this  represents  a  recognition  of  the  special 
requirements  of  high  hazard  operations. 

6.  G.I.  Rochlin,  "'High  Reliability'  Organizations  and 
Technical  Change;  Some  Ethical  Problems  and  Dilemmas," 
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IEEE  Technology  and  Society  Magazine,  Sept.  1986. 
Discusses  the  distribution  of  responsibilities  in 
'high-  reliability  organizations,  including  aircraft 
carriers  at  sea,  with  special  attention  given  to  the 
ethical  dimensions  and  assumptions  of  moral 
responsibility  for  operational  safety  and  reliability. 

7.  G.I.  Rochlin,  T.R.  LaPorte,  K.H.  Roberts,  "The 
Self-Designing  High  Reliability  Organization;  Aircraft 
Carrier  Flight  Operations  At  Sea.”  Naval  War  College 
Review,  Autumn  1987,  76-90. 

Aircraft  carrier  flight  operations  at  sea  are  beset 
with  a  number  of  paradoxes  if  analyzed  in  terms  used  to 
describe  "conventional"  organizations.  This  paper 
explores  organizational  self-design  as  a  response  to 
operational  demands  and  the  ways  in  which  the  Navy 
makes  the  best  use  of  factors  such  as  high  turnover  and 
structural  ambiguity,  which  are  normally  treated  as 
negative,  counter-productive  factors  in  analyzing 
organizational  performance. 

8.  G.I.  Rochlin,  "High-Tech,  Low-Tech,  and  No-Tech 
Complexity:  Technol.'tgy  and  Organization  in  U.s.  Naval 
Flight  Operations  at  Sea." 

Paper  presented  to  Section  on  Military  Studies, 
International  Studies  Association,  Atlanta,  GA,  Sept. 
1987. 

This  paper  analyzes  the  peculiar  mix  of  "high"  and 
"low"  technologies  used  in  aircraft  carrier  flight 
operations,  discussing  the  balance  chosen  between  the 
need  for  very  advanced  technologies  to  meet  external 
threats  and  the  desire  for  simple,  more  robust  new 
where  the  need  for  operational  reliability  is 
paramount. 

9.  K.  H.  Roberts,  "Some  Characteristics  of  High 

Reliability  Organizations".  Submitted  to 

Organizational  Sciences.  Jan.  1988. 

This  paper  identifies  some  characteristics  of  high 
reliability  organizations  that  are  similar  to  or 
different  from  those  characteristics  of  high  risk 
organizations  identified  by  Perrow  (1984)  and 
Shrivastava  (1987)  of  their  analysis  of  major 
organizational  catastrophes.  The  paper  shows  how  high 
reliability  organizations  mediate  against  some  of  the 
dysfunctional  characteristics  of  high  risk 
organizations.  Examples  are  drawn  from  USS  Carl 
Vinson,  USS  Enterprise,  USS  Theodore  Roosevelt  and  an 
Air  Force  phased  array  early  warning  system. 

10.  T.R.  La  Porte,  "Operational  Design  for  CVNs\CVWs  in 
Battle  Group  Configuration:  Feedback  from  the  Field," 
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Fftbruary,  1988. 

Drawn  from  the  final  three  weeKs  of  at  sea 
observations,  this  paper  discusses  three  situations 
that  night  call  for  nodest  changes  in  the  relations  of 
a  CVN/CVW  team  to  upper  level  units.  Each  change 
responds  to  the  same  underlying  condition,  Increase 
Interdependence  and  complexity  among  battle  group  and 
ship  board  elements. 

11.  K.H.  Roberts,  J.  Halpern,  S.  stout.  "Organizational 
and  Cognitive  Factors  Influencing  Decision  Making  in  a 
High  Reliability  Organization."  Submitted  to  Academy 
of  Management  Joiimal.  July  1988 

Individual  decision  making  propensities,  such  as  the 
tendency  toward  miserliness,  the  impact  of 
accountability,  and  the  effects  of  commitment  on  a 
decision  makers  behavior,  are  examined  in  the  context 
of  organizational  constraints  on  decision  making  (such 
as  the  existence  of  SOPs  and  restriction  in  amount  of 
information  flow) .  The  operation  of  these  propensities 
and  constraints  are  illustrated  with  two  decision 
making  scenarios  drawn  from  two  aircraft  carriers. 

12.  K.H.  Roberts  and  G.  Gargano,  "Redundancy  and 
Interdependence  in  a  High  Reliability  Organization." 
Submitted  to  Academy  of  M£magement  Review.  Aug.  1988. 
This  paper  extends  on  the  previously  mentioned 
interdependence  paper  by  examining  components  of  a 
theory  of  interdependence  and  discussing  the 
relationship  of  interdependence,  complexity,  and  system 
stability. 

13.  K.H.  Roberts,  D  M.  Rousseau  and  T.R.  LaPorte,  "The 
Culture  of  High  Reliability  Organizations."  working 
paper,  Aug.  1988. 

Using  a  sample  of  approximately  five  hundred 
respondents  from  USS  Carl  Vinson,  this  paper  discusses 
the  culture  of  high  reliability  organizations  along  the 
twelve  scales  of  Cooke  and  Rousseau's  (1986) 
organization  culture  inventory.  It  also  examines  the 
relationship  of  culture,  communication,  and  commitment 
in  this  organization. 

14.  T.R.  La  Porte  and  P.  Consolini,  "High  Reliability 

Organizations:  Challenges  to  Organization  Theory," 

paper  presented  at  the  American  Political  Science 
Association  meeting,  Washington,  D.C.,  Sept.,  1988. 
Drawing  from  work  on  two  high  reliability  organizations 
-  air  traffic  control  and  aircraft  carrier  operations 
at  sea  -  this  paper  outlines  phenomena  that  challenge 
the  adequacy  of  contemporary  organization  theory  to 
provide  explanation.  Of  particular  interest  is  the 
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emphasis  on  extreme  error  avoidance  a  theoretically 
impossible  condition  -  and  the  resulting  patterns  of 
decision-making  and  mix  of  authority  relations  and 
operating  modes. 

15.  G.I.  Rochlin,  "Organizational  Structure  and  Operational 
Effectiveness  in  Complex  Military  Organizations:  Naval 
Flight  Operations  as  a  Case  Study,"  paper  presented  at 
the  American  Political  Science  Association  meeting, 
Washington,  D.C.,  Sept.,  1988. 

During  a  typical  flying  day,  the  various  command  and 
operational  units  aboard  a  U.S.  aircraft  carrier  may 
reorganize  the  lines  of  authority  and  negotiation 
several  times,  adapting  in  each  case  to  the  demands  of 
the  moment  and  the  task  at  hand.  Operational  history 
and  high  demand  are  shown  to  be  determining  in  the 
maintenance  of  this  fluidity  structure  in  nominally 
formal  and  hierarchical  organization. 

16.  K.H.  Roberts,  "Bishop  Rock  Dead  Ahead:  The  Grounding  of 
the  U.S.S.  Enterprise,"  Naval  Institute  Proceedings, 
(in  press) . 

In  November,  1985,  USS  Enterprise  grounded  on  Bishop 
Rock  shoal  in  the  Navy^s  Southern  California  Operations 
Area.  This  paper  discusses  the  antecedents  to  that 
grounding. 

17.  K.H.-  Roberts  and  G.  Gargano,  "Managing  a  High 
Reliability  Organization:  A  Case  for  Interdependence." 
In  M.A.  Von  Glinow  and  S.  Mohrmon,  (Eds.),  Managing 
Complexity  in  High  Technology  Industries:  Systems  and 
People.  New  York:  Oxford  University  Press,  1988. 

This  paper  defines  five  types  of  interdependence  that 
can  occur  in  high  reliability  organizations.  It  then 
presents  a  number  of  tensions  that  the  organizational 
literature  predicts  about  interdependence  and  related 
issues  in  high  risk  organizations.  These  paradoxes  are 
illustrated  through  observational  and  questionnaire 
data  collected  aboard  USS  Enterprise  and  USS  Carl 
Vinson. 


18.  K.  H.  Roberts  and  S.  Sloane,  "An  Aggregation  Problem 
and  organizational  Effectiveness,"  in  B.  Schneider  and 
D.  Schoornman,  eds..  Facilitating  Work  Effectiveness. 
Lexington,  MA:  Lexington  Press,  1988. 

This  paper  briefly  reviews  the  major  aggregation  issues 
in  organization  research.  It  then  focusses  on  the 
linkage  problem  as  an  aggregation  issue.  The 
simultaneous  presence  of  three  kinds  of  linkages 
(function,  communication,  and  authority)  are 
illustrated  by  observations  made  aboard  USS  Carl 
Vinson. 
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19. 


K.H.  Roberts  and  D.M.  Rousseau,  "Research  in  Nearly 
Fallure-Free,  High  Reliability  systems:  'Having  the 
Bubble',"  IEEE  Transactions,  (in  press) 

The  methodological  challenges  and  problems  of  doing 
research  in  high  reliability  organizations  are 
described.  The  paper  begins  with  a  description  of  the 
distinctiveness  of  high  reliability  organizations;  then 
discusses  issues  of  entre,  problem  identification, 
studying  systems  and  events,  data  gathering  and 
interpretation . 

20.  K.H.  Roberts,  "An  Evaluative  Review  of  Perrow's  Normal 
Accidents."  Academy  of  Mamagement  Review,  forthcoming 
1989. 

This  review  focusses  on  the  influence  of  Perrow's  book 
influence  on  Robert's  research  on  "high  reliability 
organizations"  via  her  response  to  a  number  of  issues 
raised  in  the  book. 


Papers  dealing  with _ gth.eg _ High _ Rej  iabjU.t.y 

ocgaoigg.tlgngt 

21.  T.R.  La  Porte,  "The  Search  of  Nearly  Error-Free 
Management:  Lessons  from  U.S.  Air  Traffic  Control  for 
the  Future  of  Nuclear  Energy,"  Colloquium  Series, 
Woodrow  Wilson  International  Center  for  Schoxars, 
Smitho^nian  Institution,  Washington,  D.C.,  Nov.  1980. 
Rev.  1984. 

This  ^aper  outlines  the  requisites  for  what  we  now  call 
"high  reliability  organizations",  and  shows  how  the 
FAA's  Air  Traffic  Control  operations  meets  them. 
Comparisons  are  made  to  the  U.S.  nuclear  power 
industry. 

22.  T.R.  La  Porte,  "On  the  Design  and  Management  of  Nearly 

Error-Free  Organizational  Control  Systems",  in  D. 
Sills,  C.  Wolf  and  V.  Shelanski,  eds.,  The  Accident  and 
Three  Mile  Island:  The  Human  Dimensions.  Westview 

Press,  Boulder,  CO.,  1982 

Part  of  the  Social  Science  Research  Council's  response 
to  the  Three  Mile  Island  Disaster,  the  paper  discusses 
the  requisites  for  what  we  then  called  "nearly 
error-free"  management  in  the  context  of  the  nuclear 
fuel  cycle. 

23.  T.R.  La  Porte,  "Technology-As-Social-Organization: 
Implications  for  Policy  Analysis,"  Working  Paper  84-1, 
Studies  in  Public  Organization,  Institute  of 
Governmental  Studies,  University  of  California, 
Berkeley,  Jan.  1984. 

This  paper  extends  the  conception  of  technology  to 
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include  various  organizational  properties  necessary  to 
express  technologies  in  large  scale  form.  Properties 
that  prompt  the  demand  for  high  levels  of  operational 
reliability  are  included. 

24.  T.R.  La  Porte  and  T.  Lascher,  "Cold  Turkeys  and  Task 
Forces:  Pursuing  High  (Electric  Power)  Reliability  in 
California's  Central  Valley,”  July  1987. 

This  is  a  case  study  of  a  district  in  which  above 
average  outages  had  been  experienced  for  several  years, 
the  reasons  why  this  was  the  case,  and  the  remarkable 
response  of  the  utility  when  the  problem  was  finally 
pin-pointed.  The  case  highlights  several  properties  of 
large  networked  technical  systems. 

25.  T.R.  La  Porte,  "The  United  States  Air  Traffic  System: 
Increasing  Reliability  in  the  Midst  of  Rapid  Growth,” 
in  T.  Hughes,  and  R.  Mayntz,  eds.,  The  Development  of 
Large  Technical  Systems  (New  York:  Martinus  Vijhoff, 
1988. ) 

This  paper  traces  the  evolution  of  U.S.  Air  Traffic 
Control  from  1936-1980  and  outlines  a  number  of 
important  properties  of  high  reliability,  large 
networked  technical  systems. 


66 


HIGH  RELIABILITY  ORGANIZATION  PROJECT 


University  of  California 
Berkeley,  California 

Project  Overview  -  February  1988 


Faculty  Group: 

Geoffrey  Gosling,  Trsinsportation  Engineering 

Air  Traffic  Control;  Computer  Applications 

Todd  R.  La  Porte,  Political  Science  -  Co-chair 

Organization  Processes;  Response  to  Complex  Technologies 

Karlene  H.  Roberts,  Business  Administration  -  Co-chair 

Organizational  Behavior;  Decision  and  Group  Processes 

Gene  I.  Rochlin',  Energy  and  Resources 

Technology  and  Organizations;  Energy  and  Regulation 


orresponding  Member: 

Charles  Perrow,  Department  of  Sociology,  Yale  University  - 
Organization  Theory  and  Risk  Management 
Denise  M.  Rousseau,  School  of  Business  Administation 
Northwestern  University  -  Organizational  Behavior 
and  Methodology. 

W.  Richard  Scott,  Department  of  Sociology,  Stanford 
University  -  Organization  Theory 
Karl  Weick,  School  of  Business  Administration 
University  of  Michigan,  Ann  Arbor; 

Social  Psychology  and  Organizational  Behavior 


Student  Participants: 

Paula  Consolini,  Political  Science 

Chris  Demchak,  Political  Science  (Ph.D.  Diss.) 

Ted  Lascher,  Political  Science 

Suzeinne  Stout,  School  ot  Business  Administration, 
Stanford  University 


Prepared  by  Todd  R.  La  Porte 
Institute  of  Governmental  Studies 


The  project  begem,  summer. 1984,  within  a  small  group  of  Berkeley  faculty 
[*  and  Note  1]  who  were  meeting  regularly  to  discuss  an  organizational 
problem  of  increasing  salience  -  the  performance  of  a  growing  class  of 
organizations  in  both  the  public  and  private  sectors  charged  with  tasks  for 
which  the  societal  and  organizational  costs  of  "errors"  or  "failures"  are 
extremely  high. [2]  Few  organizations  perform  such  tasks  well,  yet  our 
society  increasingly  demands  that  significant  errors  be  avoided  in 
organizations  performing  a  host  of  critical  tasks,  e.g. ,  toxic  waste  disposal 
or  nuclear  power  plant  operation. [**] 

A  series  of  workshops  brought  together  senior  operating  officials  from 
three  "high  reliabilty"  organizations  located  nearby:  the  FAA's  Oakland 
Enroute  Air  Traffic  Control  Center.  PG&E's  Electric  Operations  Division,  the 
senior  officers  of  the  nuclear  powered  aircraft  carrier,  U.S.S.  Carl  Vinson. 

A  strikingly  similar  set  of  problems  -  and  solutions  -  emerged  from  these 
discussions.  None  of  these  organizations  had  been  studied  systematically. 
Each  was  quite  interested  in  further  study  and  opened  itself  to  us. 
Fortuitously,  we  had  had  substantial  experience  with  each  one  in  earlier  and 
somewhat  imrelated  projects.  We  eagerly  took  up  the  opportunity  to  study  a 
small  group  of  organizations  whose  performance  not  only  meets,  but  exceeds 
criteria  and  expectations  based  on  other  experiences . [3] 

Each  of  these  organizations  perform  very  complex  and  demanding  tasks 
under  considerable  time  pressure,  and  do  so  with  a  near-zero  error  rate  and 
an  almost  total  absence  of  catastrophic  failure.  Based  on  our  work  thus  far, 
it  is  evident  that  they  have  a  number  of  similar  characteristics: 

--Each  organization  has  a  strong,  reasonably  concrete  sense  of  its 
primary  missions,  operational  goals  and  the  technical  means  necessary  to 
accomplish  them, 

--  All  operate  quite  powerful,  knowledge  intensive  technologies  with 
very  few  significant  operational  failures.  These  technical  systems  are 
well  known;  their  mechanisms  and  processes  can  be  nearly  completely 
specified. 


*Currrent  Berkeley  Faculty  Croup:  Geoffrey  Gosling,  Transportation 
Engineering  -  Air  Traffic  Control,  Computer  Applications;  Todd  R.  La  Porte, 
Political  Science  -  Organization  Processes,  Response  to  Complex  Technologies; 
Karlene  H,  Roberts,  Business  Administration  Organizational  Behavior.  Decision 
and  Group  Processes:  Gene  I.  Rochlin,  Energy  and  Resources  -  Technology  and 
Organizations,  Energy  and  Regulation.  Corresponding  Faculty:  Karl  Weick, 
School  of  Business  Administration,  University  of  Michigan,  Ann  Arbor  -  Social 
Psychology  and  Organizational  Behavior;  Denise  M.  Rousseau.  Business 
Administation ,  Northwestern  University  -  Organizational  Behavior  and 
Methodology:  W,  Richard  Scott,  Stanford  University  -  Organization  Theory:  and 
Charles  Perrow,  Yale  University  -  Organization  Theory. 

**  Regrettably,  NASA's  space  shuttle  launch  management  must  be  placed  in  the 
category  of  organizations  that  "failed"  under  the  joint  stress  of  demands  for 
very  high  reliability  and  operational  continuity. 


--Their  production  units,  e.g.,  power  station,  ATC  center,  or  naval 
vessel,  are  quite  complex  and  linked  together  into  large  operating 
networks,  e.g.,  power  grid,  national  system,  or  task  force,  that 
■Strongly  effects  levels  of  internal  operating  strains  and  the  capacity 
to  adjust  to  surprise. 

--  They  manage  activities  for  which  external  or  internal  consequences  of 
failure  are  perceived  to  be  great.  The  rare  operational  failure  gravely 
threatens  the  organization's  capacity  to  operate,  to  deliver  crucial 
services,  and/or  threatens  the  lives  of  its  members  or  those  of  the 
community  at  large.  As  a  result,  "errors"  such  as  near-misses  between 
aircraft,  partial  blackouts,  or  damaged  or  diverted  military  aircraft 
are  almost  as  difficult  to  tolerate  as  actual  system  failures,  e.g., 
mid-air  collisions,  extensive  system  shut  downs,  or  loss  of  aircraft  or 
lives. 

— There  is  a  high  degree  of  agreement  in  the  society  regarding  the 
events,  accidents  or  failures  to  be  avoided  (and  within  the  organization 
on  the  indications  of  the  on-set  of  such  failures.) 

—  Each  organization  has  accepted  the  signal  importance  of  reliable, 
safe  operations  as  a  major  goal  eind  there  appears  to  be  an  ethic  of 
personal  responsibility  for  the  safe  operation  of  the  whole.  There  is 
an  operating  "culture"  that  is  strongly  failure  averse.  Internal 
dynamics  and  structures  are  predominantly  influenced  by  the  requirement 
to  avoid  certain  types  of  events,  accidents  or  failures.  However  formal 
the  organization,  the  informal  operating  structure  shares  responsibility 
for  maintaining  safety  in  a  largely  non-hirerachical  way. 

--  Despite  the  diversity  of  their  tasks,  operators  in  each  system  have 
similar  working  environments,  share  similar  responsibilities, 
expectations,  objectives,  and  goals,  and  show  similar  manifestations  of 
the  stress  of  their  jobs. 

--  In  each  case,  it  is  the  Judgment,  experience,  and  trained  intuition 
of  seasoned  operators  that  is  most  responsible  for  maintaining  systems 
reliability  and  safety.  The  historical  learning  process  has  been  one  of 
trial  and  error,  but  in  an  unusual  sense.  Open  acknowledgement  of  and 
acceptance  of  responsiblity  for  past  error  is  rewarded  in  the  interest 
of  prompting  future  improvement. 

--  Organizational  structures,  authority  relationships,  and  decision¬ 
making  dynamics  appear  to  have  evolved  in  common  patterns:  there  is 
clear  separation  of  operating  from  system  maintanence,  substantial 
delegation  of  operating  authority  to  subordinate  units,  and  redundant 
information  sources  to  inform  decision-making. 

—  Each  of  these  organizations  has  seen  its  workload  increase  while  its 
resources  base  has  been  in  relative  decline  in  recent  years:  air 
traffic  has  increased  in  a  system  still  recovering  from  the  controller's 
strike  of  a  few  years  ago:  utility  grid  management  is  becoming  much  more 
complex  as  large  numbers  of  relatively  small  independent  electricity 
producers  come  on  line:  naval  aircraft  have  become  faster,  heavier,  and 
more  complex  and  deck  load  density  has  increased. 


--  Due  to  increased  relative  demand,  an  additional  level  of  sustained 
stress  has  been  added  to  the  amount  of  stress  operators  are  expected  to 
absorb  in  highly  responsible  time-urgent  jobs,  calling  for  maintaining 
absolute  performance  levels,  in  the  face  of  increasing  magnitude  and 
complexity  of  the  tasks. 

--  Computers  and  other  technical  systems  are  used,  often  extensively, 
but  primarily  as  sources  of  information  and  data  --  inputs  to  human 
judgment.  Recently,  in  the  face  of  increasing  demand,  each  organization 
has  been  pressed  to  turn  to  new  computer  technologies  in  the  hope  of 
increasing  its  operational  capa-city  without  directly  altering 
organizational  size  or  structure, 

--  Finally,  the  organizations,  by  virtue  of  their  high  reliability,  have 
been  nearly  invisible  to  the  public.  The  more  failure-free  their 
operation,  the  less  opportunity  for  "outsiders"  to  learn  about  them.  It 
appears  likely  that  policy  makers  and  interested  consumer  groups  are 
systematically  under-informed  about  the  organizations'  actual 
requirements  and  dynamics. 

Two  implications  of  this  pattern  of  conditions  follow:  unexpected, 
subtle  and  unpredictable  consequences  are  likely  to  result  from  the 
introduction  of  powerful  and  demanding  new  technical  systems  into 
organizations  as  large  and  complex  as  these;  and  criticisms  and  proposals  x'or 
change  are  likely  to  underestimate  or  misunderstand  their  consequences  for 
organizational  operations. 

The  research  group  has  undertaking  observations  in  each  of  these 
organizations  to  answer  questions  about  how  they  manage  to  attain  such  high 
levels  of  reliable  performance  while  maintaining  the  capacity  for  sustained 
peak  performance,  and  how  they  redesign  themselves  in  the  face  of 
contingencies  not  considered  by  their  original  designers.  It  is  already 
apparent  that  existing  management  and  organizational  theory  must  be  modified, 
indeed  extended,  to  address  design,  management,  training  and  related  issues. 
When  these  modifications  are  made  and  tested,  they  can  be  used  to  derive 
policies  to  help  insure  that,  as  an  increasing  numbers  of  complex  systems  are 
developed,  they  are  not  accompanied  by  a  raise  the  likelihood  of  catastrophic 
error. 

Each  of  these  studies,  briefly  described  below,  has  a  different 
technical  focus  and  unqiue  set  of  operational  and  instrumental  conditions. 
Each  is  directed  to  a  specific  set  of  immediate  concerns  identified  by  the 
particular  organization.  Our  common  objective  is  to  gain  a  deeper 
understanding  of  the  conditions  and  costs  to  the  organizations  and  their 
personnel  of  those  activities  and  stresses  associated  with  maintaining  such 
high  levels  of  reliable  performance.  This  is  enabling  us  to  identify  a 
larger  set  f  specific  operational  issues  and  alert  us  to  the  problems  of  at 
least  maintaining  or  increasing  the  operational  reliability  of  a  variety  of 
very  complex  systems. 

Finally,  an  i.mportant  aspect  of  this  work  has  been  a  senes  of  workshops 
involving  senior  operating  officers  from  each  organization.  To  date  eight 
day-long  meeting  have  been  held,  first,  on  site  in  each  organization  to  brief 


the  group  on  the  reliability  aspects  of  its  operations,  then  to  examine 
cross-cutting  and  comparative  issues,  e.g.,  the  function  and  surprises  in 
training  activites.  problems  of  formal  and  informal  control  system  management 
during  the  onset  of  operational  stress,  and  variations  of  working  group 
cultures  within  high  reliability  organizations.  Recent  workshops  have 
centered  on  provisional  findings  from  our  work  thus  far. 

Below  is  a  brief  description  of  our  work  with  each  organization. 

(Modest  support  for  this  work  has  come  from  a  number  of  sources  indicated  for 
each  study  area  along  with  those  of  the  team  that  assume  initial 
responsibility.  In  June,  we  received  a  grant  from  the  National  Science 
Foundation  to  continue  this  work.) 

1.  U.S.  Air  Traffic  Control.  (La  Porte  and  Gosling) 

[UCB,  Institute  of  Transportation  Studies] 

Study  of  the  evolution  of  ATC  was  begun  in  1980.  examining  the 
technical,  organizational  and  institutional  conditions  which  had  resulted  in 
a  stunning  level  of  operational  reliability.  Intensive  examination  of 
technical  and  organizational  changes  were  conducted  through  reviews  of 
documents  eind  extensive  interviewing  at  FAA  headquarters  in  Washington,  D.C., 
and  at  Washington  and  later  Oakland  Air  Route  Traffic  Control  Centers.  The 
PATCO  strike  so  disrupted  the  FAA  that  the  study  was  "put  on  hold"  for  nearly 
two  years  after  the  strike,  and  was  resumed  when  the  organization's 
equilibrium  was  regained.  Subsequent  work  in  Washington  and  at  Oakland 
Center  has  been  done  to  explore  1)  the  longer  lasting  effects  of  the  strike, 
and  2)  the  potential  for  surprise  and  personnel  difficulties  that  could 
accompany  the  introduction  of  the  newest  technJfcal  proposals  for  automation 
of  air  control  functions. 

In  fall  1985.  further  study  in  Washington  and  in  several  ATC  centers  was 
begun  (by  La  Porte)  to  further  the  work  begun  in  1980.  Other  work  has 
proceeded  independently  (by  Gosling)  on  aspects  of  the  use  of  "artificial 
intelligence"  for  various  ATC  functions.  Both  Gosling  and  La  Porte  have 
familiarized  themselves  with  the  operation  of  European  Air  Traffic  Control 
during  visits  to  ERUOCONTROL  facilities  near  Paris  and  Brussels,  by  La  Porte 
in  June,  1986,  and  both  La  Porte  and  Gosling  in  September  1987  with  visits  to 
EUROCONTROL  facilities  near  Paris,  Brussels,  and  the  operational  center  at 
Maastricht,  Netherlands.  La  Porte  plans  a  two  week  visit  to  the  FAA 
facilities  in  Washington,  D.C.,  spring  1988, 

Arrangements  have  been  made  to  conduct  on-site  observations  and 
interviewing  at  ATC  enroute  and  terminal  control  facilities,  especially  in 
periods  of  operational  stress. 


2,  The  Electric  Operations  Department,  Pacific  Gas  and  Electric 
Company.  (La  Porte,  Rochlin)  [UC  Energy  Researcli  Croup;  PCIE] 

Studies  began  in  1981-82  as  part  of  a  study  on  the  effects  of  dispersed 
energy  supply  on  organizational  change.  To  our  surprise,  we  discovered  that 
the  management  of  the  electical  power  distribution  grid  had  many  similarities 
to  what  we  had  found  in  the  FAA.  In  1989,  we  resumed  systematic  contacts 


with  PCiE,  with  several  briefings  on  their  operations  and  periodic 
discussions  of  the  challenges  they  face  in  the  next  decade. 

In  summer  1985.  we  continued  charting  the  evolution  of  the  grid 
management  function  and  operating  organizational  structures,  decision-  making 
dynamics,  the  demands  of  increased  conservation  and  load  management  efforts, 
and  the  changes  associated  with  new  automated  information  control 
technologies  may  have  within  PG&E  as  they  continue  to  be  the  pivotal  actor  in 
the  Western  States  power  grid.  This  general  phase  included  the  beginning  of 
systematic  study  of  the  past  decade's  development  of  the  Electric  Operations 
Department  and  an  examination  of  routine  and  emergency  switching 
decision-making  and  performance. 

Two  more  detailed  studies  were  initiated  in  winter,  1986:  tlie  first 
examined  the  organizational  effects  of  managing  the  growing  number  of  widely 
dispersed,  independently  owned  electric  power  producers.  The  second  studied 
the  political  dynamics  arising  from  a  series  of  persistant  major  outages  in  a 
large  Central  Valley  community,  and  the  utility’s  response  to  the  difficult 
technical  and  operational  problems  involved  is  nearly  completed.  This  paper 
will  be  submitted  for  publication  soon.  Workshops  were  devoted  to  each 
project. 

Arrangements  are  being  made;  1)  to  develop  an  organizational  history  of 
PCiiE's  leadership  and  operational  involvement  in  establishing  the  California 
Power  Pool,  the  association  of  utilities  increasing  tied  together  in  power 
transfers  that  greatly  improves  regional  performance,  and  2)  to  conduct 
on-site  observations  of  several  switching  centers,  especially  in  periods  of 
operational  stress. 

3.  Nuclear  Aircraft  Carriers.  (Roberts,  La  Porte.  Rochlin ) 

[UCB,  Inst,  of  Govt.  Studies,  Sch.  of  Bus.  Ad.;  Office  of 
Naval  Research,  U.S.  Navy] 

Over  two  years  ago,  initial  acquaintance  with  these  very  complex, 
tightly-packed  organizations  was  began  at  pier-side  locally  with  U.S.S.  Carl 
Vinson  and  continued  at-sea  during  an  intensive  period  of  her  deployment. 
After  intensive  briefings  on  the  ship's  operation,  two  of  us  boarded  her  for 
17  days  underway  off  Japan,  December,  1984,  to  observe  her  management  and 
technical  teams.  During  flight  operations  at-sea,  field  data  were  collected 
from  our  observations  and  the  results  of  interviews  with  her  senior  officers, 
about  how  various  of  her  department  are  managed,  how  crucial  decisions  are 
made,  and  how  her  departments  are  interlinked  to  carry  out  the  overall 
functions  of  a  modern  aircraft  carrier.  These  data  and  subsequent  at-sea 
experience  provide  foundation  for  understanding  of  the  conditions  which  have 
resulting  in  the  Carl  Vinson's  very  good  record,  and  the  potential  changes  in 
operations  that  should  or  should  not  be  seriously  considered  (including  the 
mounting  of  additional  computerized  decision  making  aids.) 

During  Summer,  I985,  in  addition  to  continued  study  of  Carl  Vinson,  we 
extended  our  work  to  include:  a)  a  parallel  study  of  U.S.S.  Enterprise,  the 
second  nuclear  carrier  in  Carrier  Group  Three  (CARGRU  3) :  and  b)  the  effects 
of  a  new  computer  based  information  system  designed  to  aid  decision-making  in 
the  command  of  CARGRU  3.  with  particular  attention  to  the  effects  on  staff 
planning  and  subsequent  relationship  to  reliable  carrier  air  operations,  and 


the  CARCRU  coordination  of  the  battle  group  underway.  This  presented  the 
opportunity  for  a  comparison  of  two  carriers,  in  the  same  command,  but  with 
quite  different  histories  -  the  Enterprise,  a  long  established  ship,  first  of 
her  class  and  the  much  newer  Vinson.  We  are  observing  the  process  each  goes 
through  during  her  readiness  "workup,"  i.e.,  the  evolution  from  early 
preparations  to  full  readiness  for  deployment  in  the  Pacific.  There  is  also 
the  opportunity  to  examine  the  interaction  of  new  technologies  with 
established  operations  on  the  performance  of  the  ships 

Research  on  Carl  Vinson  has  been  conducted  periodically  during  the 
ship's  "work-up"  to  a  full  state  of  readiness  after  undergoing  overhaul  and 
repair  routinely  carried  out  after  each  major  deployment.  The  teeun  boarded 
the  ship  for  five  at-sea  periods,  from  mid-winter  through  mid-Sept. , 1986. 

Data  collected  include  observations  of  the  ship's  navigation,  air  and  combat 
coordination  operations,  and  survey  data  on  organizational  culture,  and 
communication  from  both  elements  of  the  ship’s  Air,  Operations  and 
Engineering  Departments  and  five  squadrons  and  command  staff  of  the  Air  Wing. 
The  last  at-sea  period  was  at  a  time  of  "practiced  readiness,"  just  before 
starting  battle  patrol  in  the  Indian  Ocean,  when  operations  are  intense  and 
involve  tightly  interdependent  decision-making  dynamics. 

A  similar  study  began  with  U.S.S.  Enterprise  in  Februray,  1987.  after 
she  completed  "overhaul  and  repair."  The  final  field  segment  of  three  weeks 
of  on-board  observation  was  completed  in  Jan.  Survey  data  was  collected  from 
five  squadrons  and  several  ship's  departments.  The  team  observed  operating 
dynamics  during  four  separate  at-sea  periods.  In  addition,  several  visit 
have  been  made  to  headquarters.  Navy  Air  Force  Pacific,  San  Diego,  to 
gathering  information  on  the  quantity  and  character  of  shore  based  support  to 
ship  board  high  reliability  activities. 


NOTES 


1 .  The  three  senor  researchers  have  the  following  relevant  research  and 
experience.  T.R.  La  Porte:  research  and  advisory  experience  on  issues  of 
radioactive  waste  and  nuclear  power  plant  operation;  studies  of  California 
electric  power  system,  and  the  national  and  European  air  traffic  control 
systems,  and  for  a  decade  was  sponsored  by  the  U.S.  .Marine  Corps  as  a  user  of 
air  traffic  control  and,  for  a  short  time,  aircraft  carrier  services. 

Karlene  Roberts:  research  on  communication  and  organization  in  the  first 
Naval  Squadron  to  receive  the  F-l4  aircraft;  advisory  and  legal  experience  on 
personnel  matter  in  complex  organization  involving  hazards  to  employees. 

Gene  Rochlin:  research  on  radioactive  waste  management  and  other  aspects  of 
nuclear  technology  and  safety;  nuclear,  fossil  fueled,  and  alternative  energy 
systems,  including  distributional  effects  and  grid  management;  other  advanced 
technological  systems  including  military  technologies,  nuclear  weapons  and 
control  systems. 

2.  See,  for  example:  Todd  R.  La  Forte.  "The  Design  and  Management  of 
Nearly  Error-Free  Organizational  Control  Systems,"  in  D.  Sills.  C.  Wolf,  and 
V.  Shelanski,  eds .  The  Accident  at  Three-Mile  Island:  Human  Dimensions 
(Boulder.  CO,:  Westview  Press.  1982);  — ,  "Managing  Nuclear  Wastes," 
Society/Transactions.  July/August,  1984;  "Nuclear  Wastes:  Increasing  Scale 
and  Sociopolitical  Impacts,:  Science,  191  (7  July  1978).  22-29.  For  a  good 
description  of  the  problems  organizations  face  with  low-probability,  high 
consequence  events,  see.  C.  Ferrow,  Normal  Accidents,  (New  York:  Basic  Books, 
1984 . ) 

3.  A  striking  example  is  air  traffic  control,  where  serious  errors  can 
threaten  lives  or  completely  disrupt  commerical  air  traffic.  See  T.R.  La 
Porte,  "The  Search  for  Nearly  Error-Free  Management:  Lessons  from  Air  Traffic 
Control  for  the  Future  of  Nuclear  Energy,"  for  Colloquim  Series,  Woodrow 
Wilson  International  Center  for  Scholars,  Smithsonian  Institution,  Nov.  198O. 


High  Reliaiblity  Organization  Papers 

Listed  below  are  the  several  papers  and  notres  derived  from  this  project 
thus  far. 

1.  T.  R.  La  Porte,  "High  Reliability  Organization  Project  Summary,"  rev.  6; 
July,  1987 

2.  T.  R.  La  Porte,  "High  Reliability  Organizations:  The  Dimensions  of  the 
Research  Challenge."  March  1987 

Papers  Centrally  on  the  Carrier  work... 

3.  K.  H.  Roberts  and  D.  M.  Rousseau,  "Research  in  Nearly  Failure-Free,  High 
Reliability  Systems:  'Having  the  Bubble’,"  (submitted  to  Academy  of 
Management  Review) 

4.  G.  I.  Rochlin,  T.R.  LaPorte,  K,  H.  Roberts,  "The  Self-Designing  High 
Reliability  Organization:  Aircraft  Carrier  Flight  Operations  At  Sea."  Naval 
War  College  Review,  Autumn  1988. 

5.  K.  H.  Roberts,  "Bishop  Rock  Dead  Ahead:  The  Grounding  of  the  U.S.S. 
Enterprise."  Jan.  1987  (forthcoming.  Naval  Institute  Proceedings) 

6.  K.  H.  Roberts  and  S.  Sloane,  "An  Evaluative  History  of  U.S.S.  Carl 
Vinson."  March  1986. 

Other  papers  drawning  on  the  Navy  work. 

7.  K.  H.  Roberts  and  S.  Sloeine,  "An  Aggregation  Problem  and  Organizational 
Effectiveness,"  in  B.  Scheider  and  D.  Schoornraan,  eds..  Facilitating  Work 
Effectiveness.  Lexington  Press,  1987- 

8.  K.  H.  Roberts  and  S.  Sloane,  "Decision-Making  in  Conditions  of  Complexity 
and  Tight  Coupling,"  Feb.  1986  (submitted  to  Management  Science  Review) 

9.  G.  I.  Rochlin.  "'High  Reliability*  Organizations  and  Technical  Change: 
Some  Ethical  Problems  and  Dilemmas,"  IEEE  Technology  and  Society  Magazine, 
Sept.  1986. 

10.  G.  Rochlin,  "Technology  Specification  and  Operator  'Power'  in  Large 
Organizations:  The  Special  Case  of  Naval  Aircraft  Carrier  Flight 
Operations'",  July  1986. 

11.  K.  Weick,  "The  Role  of  Iriterpretation  in  High  Reliability  Systems." 
California  Management  Review,  1987 

12.  J.  L.  Eccles,  Interdependence  in  a  Highly  Complex  Organization,  MBA 
Thesis,  June  1986  (Study  of  on-board  interactions  between  the  Carrier  Air 
Group  and  its  host  carrier.) 


Papers  dealing  with  High  Reliability  Organizations  more  generally. 

13.  T.  R.  La  Porte  and  T.  Lascher,  "Cold  Turkeys  and  Task  Forces:  Pursuing 
High  (Electric  Power)  Reliability  in  California's  Central  Valley,"  July  1987- 

14.  T.  R.  La  Porte,  "Technology-As-Social-Organization :  Implications  for 
Policy  Analysis,"  Working  Paper  84-1,  Studies  in  Public  Organization, 
Institute  of  Governmental  Studies.  University  of  California,  Berkeley,  Jan. 
1984. 

15-  T.  R.  La  Porte.  "On  the  Design  and  Management  of  Nearly  Error-Free 
Organizational  Control  Systems",  in  D.  Sills.  C.  Wolf  and  V.  Shelanski,  eds.. 
The  Accident  and  Three  Mile  Island:  The  Human  Dimensions.  Wescview  Press. 
Boulder.  CO.,  1982 

16,  T.  R.  La  Porte.  "The  Search  of  Nearly  Error-Free  Management:  Lessons 
from  U.S.  Air  Traffic  Control  for  the  Future  of  Nuclear  Energy,"  Colloquium 
Series,  Woodrow  Wilson  International  Center  for  Scholars.  Smithsonian 
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